AWS DVA-C02 Exam Practice Questions, practice question pack
AWS · DVA-C02

AWS DVA-C02 Exam Practice Questions

557 questionsInstant PDF downloadUpdated September 2026

US$39

Try 10 questions free

Card, Apple Pay or Google Pay. Your PDF is sent by email as soon as you check out.

Pass or your money backFail the exam after using this pack and we refund it. How the guarantee works
Category:
TRY BEFORE YOU BUY

Three of the 557 questions in this pack

Question 1

A company is implementing an application on Amazon EC2 instances. The application needs to process incoming transactions.

When the application detects a transaction that is not valid, the application must send a chat message to the company's support team. To send the message, the application needs to retrieve the access token to authenticate by using the chat API.

A developer needs to implement a solution to store the access token. The access token must be encrypted at rest and in transit. The access token must also be accessible from other AWS accounts.

Which solution will meet these requirements with the LEAST management overhead?

  1. Use an AWS Systems Manager Parameter Store SecureString parameter that uses an AWS Key Management Service (AWS KMS) AWS managed key to store the access token. Add a resource-based policy to the parameter to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Parameter Store. Retrieve the token from Parameter Store with the decrypt flag enabled. Use the decrypted access token to send the message to the chat.
  2. Encrypt the access token by using an AWS Key Management Service (AWS KMS) customer managed key. Store the access token in an Amazon DynamoDB table. Update the IAM role of the EC2 instances with permissions to access DynamoDB and AWS KMS. Retrieve the token from DynamoDDecrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the message to the chat.
  3. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat.
  4. Encrypt the access token by using an AWS Key Management Service (AWS KMS) AWS managed key. Store the access token in an Amazon S3 bucket. Add a bucket policy to the S3 bucket to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Amazon S3 and AWS KMS. Retrieve the token from the S3 bucket. Decrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the massage to the chat.
Show answer and explanation

Correct answer: C. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat.

Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat. AWS Secrets Manager is purpose-built for storing sensitive data like access tokens with automatic encryption at rest using KMS, encryption in transit via TLS, and built-in resource-based policy support for cross-account access. It requires the least management overhead compared to alternatives because it handles rotation, versioning, and access control natively. Parameter Store lacks native cross-account support without workarounds, DynamoDB and S3 require manual encryption and decryption logic on the application side.

Why the other options are wrong

  • A. Parameter Store SecureString requires additional workarounds for cross-account access and is not optimized for sensitive secrets management.
  • B. DynamoDB requires manual encryption/decryption logic on EC2 instances and is not designed for secrets storage.
  • D. S3 is not designed for secrets storage and requires manual encryption/decryption handling on the application side.

Question 2

A company is running Amazon EC2 instances in multiple AWS accounts. A developer needs to implement an application that collects all the lifecycle events of the EC2 instances. The application needs to store the lifecycle events in a single Amazon Simple Queue Service (Amazon SQS) queue in the company's main AWS account for further processing.

Which solution will meet these requirements?

  1. Configure Amazon EC2 to deliver the EC2 instance lifecycle events from all accounts to the Amazon EventBridge event bus of the main account. Add an EventBridge rule to the event bus of the main account that matches all EC2 instance lifecycle events. Add the SQS queue as a target of the rule.
  2. Use the resource policies of the SQS queue in the main account to give each account permissions to write to that SQS queue. Add to the Amazon EventBridge event bus of each account an EventBridge rule that matches all EC2 instance lifecycle events. Add the SQS queue in the main account as a target of the rule.
  3. Write an AWS Lambda function that scans through all EC2 instances in the company accounts to detect EC2 instance lifecycle changes. Configure the Lambda function to write a notification message to the SQS queue in the main account if the function detects an EC2 instance lifecycle change. Add an Amazon EventBridge scheduled rule that invokes the Lambda function every minute.
  4. Configure the permissions on the main account event bus to receive events from all accounts. Create an Amazon EventBridge rule in each account to send all the EC2 instance lifecycle events to the main account event bus. Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events. Set the SQS queue as a target for the rule.
Show answer and explanation

Correct answer: D. Configure the permissions on the main account event bus to receive events from all accounts. Create an Amazon EventBridge rule in each account to send all the EC2 instance lifecycle events to the main account event bus. Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events. Set the SQS queue as a target for the rule.

bus to receive events from all accounts. Create an Amazon EventBridge rule in each account to send all the EC2 instance lifecycle events to the main account event bus. Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events. Set the SQS queue as a target for the rule. Option D correctly implements cross-account event routing by configuring the main account's event bus to receive events from other accounts, creating forwarding rules in each child account to send EC2 lifecycle events to the main account event bus, and then matching those events with an SQS queue target. This is the standard AWS pattern for centralized event collection across accounts using EventBridge's event bus permissions and rules.

Why the other options are wrong

  • A. EC2 cannot be directly configured to deliver events to another account's EventBridge; EventBridge rules in source accounts must forward events.
  • B. SQS resource policies do not directly work with EventBridge event routing across accounts; EventBridge rules and event bus permissions are the correct mechanism.
  • C. Polling Lambda every minute is inefficient, non-real-time, and not the recommended approach for event-driven architectures.

Question 3

An application is using Amazon Cognito user pools and identity pools for secure access. A developer wants to integrate the user-specific file upload and download features in the application with Amazon S3. The developer must ensure that the files are saved and retrieved in a secure manner and that users can access only their own files. The file sizes range from 3 KB to 300 MB.

Which option will meet these requirements with the HIGHEST level of security?

  1. Use S3 Event Notifications to validate the file upload and download requests and update the user interface (UI).
  2. Save the details of the uploaded files in a separate Amazon DynamoDB table. Filter the list of files in the user interface (UI) by comparing the current user ID with the user ID associated with the file in the table.
  3. Use Amazon API Gateway and an AWS Lambda function to upload and download files. Validate each request in the Lambda function before performing the requested operation.
  4. Use an IAM policy within the Amazon Cognito identity prefix to restrict users to use their own folders in Amazon S3.
Show answer and explanation

Correct answer: D. Use an IAM policy within the Amazon Cognito identity prefix to restrict users to use their own folders in Amazon S3.

prefix to restrict users to use their own folders in Amazon S3. Using IAM policies within Cognito identity prefixes allows fine-grained, attribute-based access control where users can only access S3 paths matching their identity (e.g., s3:::bucket/cognito-identity/${cognito-identity.amazonaws.com:sub}/*). This provides the highest security by enforcing access at the AWS credential level rather than relying on application-level validation. It works for all file sizes and is built-in to AWS IAM.

Why the other options are wrong

  • A. S3 Event Notifications are for triggering actions after uploads, not for validating or securing access.
  • B. DynamoDB filtering in the UI provides no actual security; users could bypass the UI and directly access files belonging to other users.
  • C. API Gateway and Lambda add complexity and management overhead compared to native IAM policy-based access control through Cognito identity.

See all 10 free questions Get the full pack, US$39

557 practice questions for AWS Certified Developer, Associate (DVA-C02), with full explanations.

Every question comes with the correct answer, the reasoning behind it, and a note on why each wrong option is wrong. Work through it once with the answers, then again with the questions-only copy under exam conditions.

  • 557 questions across all four DVA-C02 domains
  • Answers and explanations for every question, including the wrong options
  • A questions-only PDF for timed practice runs
  • Instant delivery by email the moment you check out
  • Free monthly updates for as long as the exam is live
  • Pass or your money back

A failed DVA-C02 attempt costs another US$150, plus the time it takes to restudy. This pack is US$39, paid once, and refunded if you fail.

Try 10 questions free before you buy.

Last updated September 2026 · 557 questions

What makes the DVA-C02 hard

DVA-C02 assumes you write code against AWS every day, and it tests like it. It does not ask whether you know what Lambda is; it gives you a failing function, a throttled DynamoDB table or an IAM policy that almost works, and asks what a developer would actually change. Lambda configuration and event sources, DynamoDB partition key design, API Gateway integrations, SQS versus SNS versus EventBridge, Cognito flows, CI/CD with CodePipeline and X-Ray tracing are the calls a real AWS developer makes every day.

65 questions in 130 minutes, 720 out of 1000 to pass. This pack has 557 practice questions across all four domains, so the scenario length, the distractor patterns and the serverless-heavy question style are familiar before you sit down.

About the exam

DVA-C02 certifies developers who build, deploy and debug applications on AWS, covering serverless, storage, security and CI/CD with Lambda, DynamoDB, API Gateway and the AWS developer toolchain. AWS recommends at least one year of hands-on development experience. Valid for three years.

Exam domains

  • Development with AWS services: 32%
  • Security: 26%
  • Deployment: 24%
  • Troubleshooting and optimization: 18%

65 questions, 130 minutes, pass mark 720 out of 1000, US$150 per attempt, Pearson VUE test centres or online proctored, valid for three years.

Reviews

There are no reviews yet.

Only logged in customers who have purchased this product may leave a review.

Questions before you buy

What do I get when I buy the AWS DVA-C02 pack?

557 practice questions as a PDF, each with the correct answer, a full explanation and a note on why the other options are wrong, plus a separate questions-only PDF for timed practice.

How quickly do I receive it?

Straight away. The full PDF and a questions-only copy are emailed to you the moment your payment goes through, and the same links are on your order page.

Is there a free sample?

Yes. Ten questions from this pack, with answers and explanations, are free on this page and as a PDF, so you can judge the quality before you pay.

Are updates included?

Yes. The pack is updated every month for as long as the exam is live, and updates are free for everyone who has bought it.

What if I fail the exam?

We refund the pack. Sit the exam 7 to 30 days after buying, then send your official score report within 7 days of the exam date, as set out in the refund policy.

Can I share it with colleagues?

Each purchase is licensed to one person. For a team, school or training organisation, email support@certstash.com for a licence that fits.

Related products