Sign in Register
Home  /  Blog

AWS Developer Associate Practice Questions: Lambda, DynamoDB and API Gateway Scenarios

Cloud certifications·9 min read·PractiseExam

Here are 8 multiple-choice questions designed to match the style, difficulty, and domain coverage of the AWS Developer Associate (DVA-C02) exam. --- These questions cover core developer topics including IAM, Lambda, DynamoDB, API Gateway, S3, and CI/CD. Test your knowledge, and check the explanations to understand the "why" behind each answer. ---

Question 1

A developer is writing an AWS Lambda function that needs to access a Secrets Manager secret containing database credentials. The function is configured with an IAM role that grants secretsmanager:GetSecretValue on the specific secret ARN. However, the function is failing with an AccessDeniedException. What is the MOST likely cause of this failure? Want to go further? AWS Developer Associate Passing Score: Why 720 Feels Closer Than It Looks is a good next step.

  1. A. The Lambda function's execution role does not have permission to decrypt the secret using the KMS key.
  2. B. The Lambda function needs to be in the same VPC as the Secrets Manager service.
  3. C. The secret's resource-based policy must explicitly allow the Lambda function's ARN.
  4. D. The Lambda function must use the AWS SDK v3 to retrieve secrets.

Answer: A

Explanation: Secrets Manager uses AWS KMS for encryption. Even if you have secretsmanager:GetSecretValue, you must also have kms:Decrypt permission on the specific KMS key used to encrypt the secret. Secrets Manager does not require VPC connectivity (it's a public service), and resource-based policies are optional if the IAM role already grants access.

Question 2

A developer is building a REST API using API Gateway and Lambda. They need to validate that the queryStringParameters contain a required field called userId before the Lambda function is invoked. Which strategy is the MOST efficient and cost-effective way to achieve this?

  1. A. Use a Lambda authorizer to check for the parameter and return a 400 error if missing.
  2. B. Configure a request validator on the API Gateway method and define the required parameter in the OpenAPI definition.
  3. C. Check the parameter inside the Lambda function and return a 400 error if missing.
  4. D. Use a Web Application Firewall (WAF) rule to inspect the query string for the required field.

Answer: B

Explanation: API Gateway request validators can perform basic validation (like required parameters) at the edge, preventing invalid requests from invoking your Lambda function. This saves compute time and cost. A Lambda authorizer is for authentication, not validation. Checking inside Lambda is valid but inefficient, and WAF is for security rules like IP blocking, not mandatory parameters.

Question 3

A developer is writing a script to upload a 5 GB file to Amazon S3. The upload keeps failing due to network instability. Which approach should the developer use to ensure the file is uploaded reliably?

  1. A. Use the S3 API to upload the file in a single PutObject request.
  2. B. Use the S3 multipart upload API, splitting the file into parts and uploading them in parallel.
  3. C. Upload the file to an S3 bucket in a different region and then use cross-region replication.
  4. D. Compress the file to a .zip before uploading to reduce its size.

Answer: B

Explanation: The S3 multipart upload API is designed for large files (over 100 MB) and provides better resilience. It allows you to upload parts independently and retry failed parts without restarting the entire upload. PutObject has a 5 GB limit and is not fault-tolerant. Cross-region replication is for redundancy, not upload reliability.

Question 4

A developer needs to store user session data for a web application. The data is accessed on every request and must be retrieved with extremely low latency (sub-millisecond). The developer needs to ensure that the data is not lost if a single Availability Zone fails. Which service should be used?

  1. A. Amazon S3 (Simple Storage Service)
  2. B. Amazon DynamoDB
  3. C. Amazon ElastiCache for Redis with Multi-AZ
  4. D. Amazon EBS (Elastic Block Store)

Answer: C Before moving on, consider reading AWS Developer Associate Difficulty: Where Developers Without AWS Experience Stumble.

Explanation: ElastiCache for Redis provides in-memory caching with sub-millisecond latency, and enabling Multi-AZ ensures a replica is available in another AZ for failover. DynamoDB is fast but typically single-digit millisecond latency, not sub-millisecond. S3 is too slow for session data, and EBS is a block-level storage attached to a single EC2 instance.

Question 5

A developer is using AWS CodePipeline to deploy a serverless application. They want to run a suite of integration tests against a staging environment after the deployment succeeds, but only for the main branch. How should this be configured?

  1. A. Add a test action to the deploy stage and configure the action to run only on the main branch.
  2. B. Add a test action to the source stage and use a filter condition to check the branch name.
  3. C. Add a test stage after the deploy stage and configure a branch-based condition on the stage's RunOrder.
  4. D. Add a test stage after the deploy stage and use a LambdaInvoke action that runs the tests, with a condition that checks the source branch.

Answer: D

Explanation: CodePipeline supports conditions on actions (or stages in newer versions) that can evaluate variables like the source branch name. The correct pattern is to have a test stage after deployment, with an action condition that evaluates to true only when the source branch is main. Stages don't have "RunOrder" conditions, and tests shouldn't run in the source stage.

Question 6

A developer is using Amazon DynamoDB to store application logs. The partition key is logId, and the sort key is timestamp. The developer needs to query all logs for a specific logId within the last 24 hours. Which query will be the MOST efficient?

  1. A. A Scan operation with a filter expression on logId and timestamp.
  2. B. A Query operation on the logId partition key with a condition on the timestamp sort key.
  3. C. A Query operation using a Global Secondary Index (GSI) on timestamp.
  4. D. A GetItem operation for each log entry within the last 24 hours.

Answer: B

Explanation: A Query operation is always more efficient than a Scan. Because logId is the partition key and timestamp is the sort key, you can query directly on the partition key and use a sort key condition (e.g., timestamp > :yesterday) to filter the results efficiently. A GSI is unnecessary here as the base table's key structure already supports this query.

Question 7

A developer is deploying an application that reads from an Amazon SQS queue. The Lambda function processing the messages is experiencing a high number of duplicates. The function is idempotent, but the developer wants to reduce the duplicates to save compute costs. What should the developer do?

  1. A. Increase the visibility timeout of the queue.
  2. B. Enable the queue's content-based deduplication.
  3. C. Increase the number of Lambda concurrency.
  4. D. Use a FIFO queue and configure MessageGroupId.

Answer: D

Explanation: SQS FIFO queues guarantee exactly-once processing and eliminate duplicates. The MessageGroupId ensures messages are processed in order and are not duplicated. Content-based deduplication is a feature of FIFO queues, but it alone doesn't fix the issue if the producer is sending duplicates; using a FIFO queue with a MessageGroupId is the correct fix. Visibility timeout reduces, but doesn't eliminate, duplicates. See also AWS Developer Associate Study Plan: 8 Weeks With Labs Every Weekend for a complementary perspective.

Question 8

A developer is writing a script that needs to perform a series of administrative AWS operations. For security, the script must not embed long-term credentials. The script will be run on an EC2 instance. How should the developer securely provide the necessary permissions?

  1. A. Store an IAM user's access key and secret key in the script.
  2. B. Store the credentials in a file on the EC2 instance and reference the file.
  3. C. Generate temporary credentials using the AWS Security Token Service (STS) and hardcode them in the script.
  4. D. Launch the EC2 instance with an IAM role that grants the necessary permissions.

Answer: D

Explanation: Launching the EC2 instance with an IAM role is the recommended best practice. The AWS SDK automatically retrieves temporary credentials from the instance metadata service, eliminating the need to manage or embed any credentials. Storing keys in scripts or files is a security risk, and hardcoding temporary credentials is not practical as they expire.

Question 9

A developer is using AWS Elastic Beanstalk to deploy a web application. They need to set environment-specific configuration, such as database connection strings, without hardcoding them in the application code. What is the BEST way to achieve this?

  1. A. Store the configuration in a file named config.yml in the application's source root.
  2. B. Use Elastic Beanstalk environment properties and read them from the application code.
  3. C. Hardcode the configuration in a settings.py file and commit it to the repository.
  4. D. Use a Lambda function to inject the environment variables at runtime.

Answer: B

Explanation: Elastic Beanstalk provides environment properties which are exposed to the application as environment variables. This allows developers to manage configuration separately from code and change it without redeploying the application. A config.yml is used for AWS resources, not application config, and hardcoding is a security anti-pattern.

Question 10

A developer is creating a Lambda function that processes a large file (1 GB) stored in S3. The function needs to read the file, transform the data, and write the result to another S3 bucket. The function has a timeout of 15 minutes. What is the MOST efficient way to process this file?

  1. A. Download the entire file into Lambda's /tmp directory using s3.getObject and process it.
  2. B. Use S3 batch operations to invoke the Lambda function on each object.
  3. C. Use S3 Select to retrieve only the required data from the file within the Lambda function.
  4. D. Use the s3.getObject API with the Range parameter to stream and process the file in chunks.

Answer: D

Explanation: For large files, streaming is the best approach. Using the Range parameter allows the Lambda to read the file in chunks, process each chunk, and keep memory usage low. Downloading the entire 1 GB file may exceed the Lambda memory limit (max 10 GB) and is inefficient. S3 Select is for SQL queries on CSV/JSON, not for general transformation, and batch operations are for executing on many objects, not one large file.

These scenarios represent common patterns and pitfalls in serverless and CI/CD development on AWS. Remember to always prioritize security (IAM roles, no hardcoded secrets), efficiency (Query vs. Scan, streaming vs. bulk download), and the specific guarantees of each service (FIFO vs. Standard queues). Good luck with your exam preparation!

If you are structuring your remaining prep time, the free AWS Certified Developer - Associate study plan gives you a schedule that fits your availability.

Build real confidence for exam day by completing timed AWS Certified Developer - Associate practice exams under timed conditions.

To gauge your current readiness before a timed exam, the free AWS Certified Developer - Associate readiness check gives you a quick review of weak topics.

Amazon Web ServicesAWS Developer Associatepractice-qCloud & AI
All postsSit a full-length mock