15 Free AWS Certified Developer – Associate (DVA-C02) Practice Questions with Answers (2026)

Lambda destinations for asynchronous invocations send an invocation record to the target when processing fails. The record includes the request, the response and the error details. It is pure configuration.

• A is wrong: a longer timeout may reduce some failures but does not capture the ones that still fail.
• B is wrong: limiting concurrency throttles the function and can cause more failures, not capture them.
• C is wrong: S3 event notifications do not have a retry policy or a failure queue you can configure.

When the visibility timeout expires before a worker deletes the message, the message becomes visible again and another worker picks it up. Setting the timeout above the longest processing time stops this.

• B is wrong: long polling reduces empty responses and cost, not duplicate processing.
• C is wrong: you cannot convert a standard queue to FIFO, and a FIFO queue would still redeliver a message whose visibility timeout expired.
• D is wrong: retention controls how long unread messages are kept, not when they become visible again.

A global secondary index gives the table a new partition key. A Query on that index reads only the matching item, so cost and latency stay low as the table grows.

• A is wrong: Scan reads the whole table and filters afterwards, so it is slow and expensive at this size.
• B is wrong: a local secondary index keeps the same partition key, so you would still need the customer ID. It also can only be created with the table.
• D is wrong: consistency does not change which key you can query on.

Lazy loading (cache-aside) only caches an item after a cache miss, so the cache holds what users request. A TTL makes each item expire, which limits how long stale data can be served.

• B is wrong: write-through caches every write, including products nobody reads, and with no TTL old data can linger.
• C is wrong: preloading fills the cache with items that may never be requested and goes stale as data changes.
• D is wrong: without a TTL, a cached item stays until it is evicted, so stale data can be served for a long time.

An identity pool swaps the user pool token for short-lived AWS credentials tied to an IAM role. Using the Cognito identity ID as a policy variable limits each user to their own prefix.

• A is wrong: long-term keys in a mobile app can be extracted and shared by every user.
• B is wrong: a user pool issues JSON Web Tokens, not AWS credentials.
• D is wrong: public writes let anyone upload to any prefix.

This is envelope encryption. KMS returns a data key in plaintext and encrypted form. You encrypt the data locally and keep only the encrypted data key, which KMS can decrypt later.

• A is wrong: the KMS Encrypt API only accepts up to 4 KB of plaintext.
• C is wrong: you cannot export key material from a KMS key.
• D is wrong: SSE-S3 is server-side encryption, and the requirement is client-side.

Secrets Manager has built-in rotation for RDS credentials. The function fetches the current secret at runtime, ideally with caching, so rotation needs no redeploy.

• A is wrong: environment variables do not rotate, and changing one means updating the function configuration.
• B is wrong: Parameter Store SecureString parameters have no built-in automatic rotation.
• C is wrong: a password in the package is hard-coded and needs a redeploy to change.

A Cognito user pool authorizer validates the user pool token for you. No code is needed.

• B is wrong: a Lambda authorizer would work, but it is custom code you have to write and maintain.
• C is wrong: IAM authorization needs AWS credentials, and these users only have user pool tokens.
• D is wrong: API keys are for throttling and quotas, not for authenticating users.

SAM uses AWS CodeDeploy to shift traffic between Lambda versions behind an alias. A canary sends 10% first, then the rest after 10 minutes, and rolls back if a listed alarm goes off.

• A is wrong: $LATEST changes instantly for all traffic, with no gradual shift or rollback.
• B is wrong: linear adds 10% every 10 minutes, so the full shift takes about 100 minutes.
• D is wrong: Route 53 routes DNS traffic, not direct Lambda invocations, and gives no automatic rollback.

Stage variables let one integration point at different aliases per stage. Each alias needs a resource-based permission so API Gateway can invoke it.

• A is wrong: it works but duplicates the API, which the requirement rules out.
• C is wrong: environment variables are set on the function, not per caller, so they cannot route stages to different aliases.
• D is wrong: usage plans control throttling and quotas, not integrations.

The AWS SAM CLI can generate sample event payloads and invoke the function locally in a container that mimics the Lambda runtime.

• A is wrong: testing in production is risky and is not local.
• B is wrong: a change set previews infrastructure changes. It does not run code.
• C is wrong: CodeBuild runs builds in AWS, not on the laptop, and does not supply an S3 event.

Annotations are indexed key-value pairs. You can search for them with filter expressions, such as finding every trace where the tier is premium.

• A is wrong: metadata is stored with the trace but is not indexed, so you cannot filter on it.
• B is wrong: a log field does not let you filter traces in X-Ray.
• D is wrong: more sampling records more traces but does not label them.

With EMF, the function writes a structured JSON log entry, and CloudWatch extracts the metrics asynchronously. No extra API calls and no parsing rules.

• B is wrong: PutMetricData adds an API call to every invocation, with latency and throttling risk.
• C is wrong: metric filters are log parsing rules you have to define and maintain.
• D is wrong: subsegments are for tracing, not for publishing custom metrics.

Reserved concurrency sets aside part of the account's concurrency for one function. No other function can use it, and it has no extra charge.

• A is wrong: memory changes CPU and speed, not how much concurrency the function can get.
• C is wrong: provisioned concurrency targets cold-start latency and is billed extra, which the team wants to avoid.
• D is wrong: a longer timeout keeps each invocation running longer, which uses more concurrency, not less.