Free AWS DVA-C02 practice questions

10 free AWS DVA-C02 practice questions with the correct answer and a full explanation for each, taken from the CertStash pack of 557 questions. Work through them, then open each answer to check your reasoning.

Get all 557 questions (US$39) · Download these 10 as a PDF

Question 1

A company is implementing an application on Amazon EC2 instances. The application needs to process incoming transactions.

When the application detects a transaction that is not valid, the application must send a chat message to the company's support team. To send the message, the application needs to retrieve the access token to authenticate by using the chat API.

A developer needs to implement a solution to store the access token. The access token must be encrypted at rest and in transit. The access token must also be accessible from other AWS accounts.

Which solution will meet these requirements with the LEAST management overhead?

  1. Use an AWS Systems Manager Parameter Store SecureString parameter that uses an AWS Key Management Service (AWS KMS) AWS managed key to store the access token. Add a resource-based policy to the parameter to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Parameter Store. Retrieve the token from Parameter Store with the decrypt flag enabled. Use the decrypted access token to send the message to the chat.
  2. Encrypt the access token by using an AWS Key Management Service (AWS KMS) customer managed key. Store the access token in an Amazon DynamoDB table. Update the IAM role of the EC2 instances with permissions to access DynamoDB and AWS KMS. Retrieve the token from DynamoDDecrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the message to the chat.
  3. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat.
  4. Encrypt the access token by using an AWS Key Management Service (AWS KMS) AWS managed key. Store the access token in an Amazon S3 bucket. Add a bucket policy to the S3 bucket to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Amazon S3 and AWS KMS. Retrieve the token from the S3 bucket. Decrypt the token by using AWS KMS on the EC2 instances. Use the decrypted access token to send the massage to the chat.
Show answer and explanation

Correct answer: C. Use AWS Secrets Manager with an AWS Key Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat.

Management Service (AWS KMS) customer managed key to store the access token. Add a resource-based policy to the secret to allow access from other accounts. Update the IAM role of the EC2 instances with permissions to access Secrets Manager. Retrieve the token from Secrets Manager. Use the decrypted access token to send the message to the chat. AWS Secrets Manager is purpose-built for storing sensitive data like access tokens with automatic encryption at rest using KMS, encryption in transit via TLS, and built-in resource-based policy support for cross-account access. It requires the least management overhead compared to alternatives because it handles rotation, versioning, and access control natively. Parameter Store lacks native cross-account support without workarounds, DynamoDB and S3 require manual encryption and decryption logic on the application side.

Why the other options are wrong

  • A. Parameter Store SecureString requires additional workarounds for cross-account access and is not optimized for sensitive secrets management.
  • B. DynamoDB requires manual encryption/decryption logic on EC2 instances and is not designed for secrets storage.
  • D. S3 is not designed for secrets storage and requires manual encryption/decryption handling on the application side.

Question 2

A company is running Amazon EC2 instances in multiple AWS accounts. A developer needs to implement an application that collects all the lifecycle events of the EC2 instances. The application needs to store the lifecycle events in a single Amazon Simple Queue Service (Amazon SQS) queue in the company's main AWS account for further processing.

Which solution will meet these requirements?

  1. Configure Amazon EC2 to deliver the EC2 instance lifecycle events from all accounts to the Amazon EventBridge event bus of the main account. Add an EventBridge rule to the event bus of the main account that matches all EC2 instance lifecycle events. Add the SQS queue as a target of the rule.
  2. Use the resource policies of the SQS queue in the main account to give each account permissions to write to that SQS queue. Add to the Amazon EventBridge event bus of each account an EventBridge rule that matches all EC2 instance lifecycle events. Add the SQS queue in the main account as a target of the rule.
  3. Write an AWS Lambda function that scans through all EC2 instances in the company accounts to detect EC2 instance lifecycle changes. Configure the Lambda function to write a notification message to the SQS queue in the main account if the function detects an EC2 instance lifecycle change. Add an Amazon EventBridge scheduled rule that invokes the Lambda function every minute.
  4. Configure the permissions on the main account event bus to receive events from all accounts. Create an Amazon EventBridge rule in each account to send all the EC2 instance lifecycle events to the main account event bus. Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events. Set the SQS queue as a target for the rule.
Show answer and explanation

Correct answer: D. Configure the permissions on the main account event bus to receive events from all accounts. Create an Amazon EventBridge rule in each account to send all the EC2 instance lifecycle events to the main account event bus. Add an EventBridge rule to the main account event bus that matches all EC2 instance lifecycle events. Set the SQS queue as a target for the rule.

Option D correctly implements cross-account event routing by configuring the main account's event bus to receive events from other accounts, creating forwarding rules in each child account to send EC2 lifecycle events to the main account event bus, and then matching those events with an SQS queue target. This is the standard AWS pattern for centralized event collection across accounts using EventBridge's event bus permissions and rules.

Why the other options are wrong

  • A. EC2 cannot be directly configured to deliver events to another account's EventBridge; EventBridge rules in source accounts must forward events.
  • B. SQS resource policies do not directly work with EventBridge event routing across accounts; EventBridge rules and event bus permissions are the correct mechanism.
  • C. Polling Lambda every minute is inefficient, non-real-time, and not the recommended approach for event-driven architectures.

Question 3

An application is using Amazon Cognito user pools and identity pools for secure access. A developer wants to integrate the user-specific file upload and download features in the application with Amazon S3. The developer must ensure that the files are saved and retrieved in a secure manner and that users can access only their own files. The file sizes range from 3 KB to 300 MB.

Which option will meet these requirements with the HIGHEST level of security?

  1. Use S3 Event Notifications to validate the file upload and download requests and update the user interface (UI).
  2. Save the details of the uploaded files in a separate Amazon DynamoDB table. Filter the list of files in the user interface (UI) by comparing the current user ID with the user ID associated with the file in the table.
  3. Use Amazon API Gateway and an AWS Lambda function to upload and download files. Validate each request in the Lambda function before performing the requested operation.
  4. Use an IAM policy within the Amazon Cognito identity prefix to restrict users to use their own folders in Amazon S3.
Show answer and explanation

Correct answer: D. Use an IAM policy within the Amazon Cognito identity prefix to restrict users to use their own folders in Amazon S3.

Using IAM policies within Cognito identity prefixes allows fine-grained, attribute-based access control where users can only access S3 paths matching their identity (e.g., s3:::bucket/cognito-identity/${cognito-identity.amazonaws.com:sub}/*). This provides the highest security by enforcing access at the AWS credential level rather than relying on application-level validation. It works for all file sizes and is built-in to AWS IAM.

Why the other options are wrong

  • A. S3 Event Notifications are for triggering actions after uploads, not for validating or securing access.
  • B. DynamoDB filtering in the UI provides no actual security; users could bypass the UI and directly access files belonging to other users.
  • C. API Gateway and Lambda add complexity and management overhead compared to native IAM policy-based access control through Cognito identity.

Question 4

A company is building a scalable data management solution by using AWS services to improve the speed and agility of development. The solution will ingest large volumes of data from various sources and will process this data through multiple business rules and transformations.

The solution requires business rules to run in sequence and to handle reprocessing of data if errors occur when the business rules run. The company needs the solution to be scalable and to require the least possible maintenance.

Which AWS service should the company use to manage and automate the orchestration of the data flows to meet these requirements?

  1. AWS Batch
  2. AWS Step Functions
  3. AWS Glue
  4. AWS Lambda
Show answer and explanation

Correct answer: B. AWS Step Functions

AWS Step Functions is purpose-built for orchestrating workflows with sequential execution of tasks, built-in error handling and retry logic, and automatic reprocessing capabilities. It requires minimal maintenance, scales automatically, and provides state machine-based orchestration ideal for managing complex business rules and transformations in sequence.

Why the other options are wrong

  • A. AWS Batch is for large-scale parallel batch computing, not sequential orchestration with error handling.
  • C. AWS Glue is an ETL service focused on data cataloging and transformation, not workflow orchestration.
  • D. AWS Lambda alone lacks native orchestration, sequencing, and error handling for complex multi-step workflows.

Question 5

A developer has created an AWS Lambda function that is written in Python. The Lambda function reads data from objects in Amazon S3 and writes data to an Amazon DynamoDB table. The function is successfully invoked from an S3 event notification when an object is created. However, the function fails when it attempts to write to the DynamoDB table.

What is the MOST likely cause of this issue?

  1. The Lambda function's concurrency limit has been exceeded.
  2. DynamoDB table requires a global secondary index (GSI) to support writes.
  3. The Lambda function does not have IAM permissions to write to DynamoDB.
  4. The DynamoDB table is not running in the same Availability Zone as the Lambda function.
Show answer and explanation

Correct answer: C. The Lambda function does not have IAM permissions to write to DynamoDB.

The Lambda function successfully reads from S3 (proven by successful invocation and data reading), but fails on DynamoDB writes. This indicates the execution role lacks DynamoDB write permissions. IAM permissions are the most common cause of such write failures in Lambda. The function needs explicit permissions to perform PutItem or similar write operations on the DynamoDB table.

Why the other options are wrong

  • A. Concurrency limits would prevent invocation, not individual write failures; the function is being invoked successfully.
  • B. GSI is optional and not required for basic write operations; tables write to the base table automatically.
  • D. Lambda can write to DynamoDB in any region/AZ; there is no AZ-based restriction for DynamoDB writes.

Question 6

A developer is creating an AWS CloudFormation template to deploy Amazon EC2 instances across multiple AWS accounts. The developer must choose the EC2 instances from a list of approved instance types.

How can the developer incorporate the list of approved instance types in the CloudFormation template?

  1. Create a separate CloudFormation template for each EC2 instance type in the list.
  2. In the Resources section of the CloudFormation template, create resources for each EC2 instance type in the list.
  3. In the CloudFormation template, create a separate parameter for each EC2 instance type in the list.
  4. In the CloudFormation template, create a parameter with the list of EC2 instance types as AllowedValues.
Show answer and explanation

Correct answer: D. In the CloudFormation template, create a parameter with the list of EC2 instance types as AllowedValues.

CloudFormation parameters with AllowedValues constraint restrict user input to a predefined list of approved EC2 instance types. This is the cleanest, most maintainable approach that enforces the list at template design time and provides validation during stack creation. Users cannot select instance types outside the approved list.

Why the other options are wrong

  • A. Creating separate templates for each instance type is inefficient and not scalable.
  • B. Creating resources for each instance type in the Resources section would create all instances, not allow selection of one.
  • C. Creating separate parameters for each instance type is redundant and does not provide a unified list constraint.

Question 7

A developer has an application that makes batch requests directly to Amazon DynamoDB by using the BatchGetItem low-level API operation. The responses frequently return values in the UnprocessedKeys element.

Which actions should the developer take to increase the resiliency of the application when the batch response includes values in UnprocessedKeys? (Choose two.)

  1. Retry the batch operation immediately.
  2. Retry the batch operation with exponential backoff and randomized delay.
  3. Update the application to use an AWS software development kit (AWS SDK) to make the requests.
  4. Increase the provisioned read capacity of the DynamoDB tables that the operation accesses.
  5. Increase the provisioned write capacity of the DynamoDB tables that the operation accesses. ✅Correct Answer: B, C
  6. Retry the batch operation with exponential backoff and randomized delay.
  7. Update the application to use an AWS software development kit (AWS SDK) to make the requests. UnprocessedKeys means part of the batch was throttled or could not be returned. The recommended fix is to retry only the remaining keys using exponential backoff with jitter, which spreads out retries so they succeed. AWS SDKs provide this resiliency automatically, implementing backoff and jitter retries for throttled or unprocessed items without hand-written code.
Show answer and explanation

Answer and explanation for question 7

Question 8

A company is running a custom application on a set of on-premises Linux servers that are accessed using Amazon API Gateway. AWS X-Ray tracing has been enabled on the API test stage.

How can a developer enable X-Ray tracing on the on-premises servers with the LEAST amount of configuration?

  1. Install and run the X-Ray SDK on the on-premises servers to capture and relay the data to the X-Ray service.
  2. Install and run the X-Ray daemon on the on-premises servers to capture and relay the data to the X-Ray service.
  3. Capture incoming requests on-premises and configure an AWS Lambda function to pull, process, and relay relevant data to X-Ray using the PutTraceSegments API call.
  4. Capture incoming requests on-premises and configure an AWS Lambda function to pull, process, and relay relevant data to X-Ray using the PutTelemetryRecords API call.
Show answer and explanation

Correct answer: B. Install and run the X-Ray daemon on the on-premises servers to capture and relay the data to the X-Ray service.

The X-Ray daemon is the minimal installation required on on-premises servers to capture and relay trace data to the X-Ray service. The daemon runs as a background process, receives trace segments from applications over UDP, and batches and forwards them to AWS using credentials you supply. This requires the least configuration compared to SDK installation, which needs code integration and language-specific setup.

Why the other options are wrong

  • A. The SDK requires code integration into the application itself, which is more configuration than just running a daemon.
  • C. Lambda-based pulling and processing adds unnecessary complexity and latency; the daemon is simpler.
  • D. PutTelemetryRecords uploads only daemon telemetry counters, not trace segments, and the Lambda relay is extra work.

Question 9

A company wants to share information with a third party. The third party has an HTTP API endpoint that the company can use to share the information. The company has the required API key to access the HTTP API.

The company needs a way to manage the API key by using code. The integration of the API key with the application code cannot affect application performance.

Which solution will meet these requirements MOST securely?

  1. Store the API credentials in AWS Secrets Manager. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.
  2. Store the API credentials in a local code variable. Push the code to a secure Git repository. Use the local code variable at runtime to make the API call.
  3. Store the API credentials as an object in a private Amazon S3 bucket. Restrict access to the S3 object by using IAM policies. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.
  4. Store the API credentials in an Amazon DynamoDB table. Restrict access to the table by using resource-based policies. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.
Show answer and explanation

Correct answer: A. Store the API credentials in AWS Secrets Manager. Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call.

Retrieve the API credentials at runtime by using the AWS SDK. Use the credentials to make the API call. AWS Secrets Manager is purpose-built for managing API keys, credentials, and other sensitive data. It provides automatic rotation, fine-grained access control via IAM, encryption at rest with KMS, and SDK client-side caching so runtime retrieval does not affect application performance. The secret is referenced programmatically, so no credential is ever stored in code.

Why the other options are wrong

  • B. Storing credentials in code variables and pushing to Git, even a secure repository, violates security best practices and creates exposure risks.
  • C. S3 is object storage, not a secrets store; it offers no managed rotation or secret versioning workflow for credentials.
  • D. DynamoDB is a database, not a secrets store; it offers no managed rotation or secret lifecycle handling, so you must build and secure that yourself.

Question 10

A developer is deploying a new application to Amazon Elastic Container Service (Amazon ECS). The developer needs to securely store and retrieve different types of variables. These variables include authentication information for a remote API, the URL for the API, and credentials. The authentication information and API URL must be available to all current and future deployed versions of the application across development, testing, and production environments.

How should the developer retrieve the variables with the FEWEST application changes?

  1. Update the application to retrieve the variables from AWS Systems Manager Parameter Store. Use unique paths in Parameter Store for each variable in each environment. Store the credentials in AWS Secrets Manager in each environment.
  2. Update the application to retrieve the variables from AWS Key Management Service (AWS KMS). Store the API URL and credentials as unique keys for each environment.
  3. Update the application to retrieve the variables from an encrypted file that is stored with the application. Store the API URL and credentials in unique files for each environment.
  4. Update the application to retrieve the variables from each of the deployed environments. Define the authentication information and API URL in the ECS task definition as unique names during the deployment process.
Show answer and explanation

Correct answer: A. Update the application to retrieve the variables from AWS Systems Manager Parameter Store. Use unique paths in Parameter Store for each variable in each environment. Store the credentials in AWS Secrets Manager in each environment.

AWS Systems Manager Parameter Store. Use unique paths in Parameter Store for each variable in each environment. Store the credentials in AWS Secrets Manager in each environment. AWS Systems Manager Parameter Store allows centralized management of application configuration across multiple environments with minimal code changes. It supports hierarchical paths for environment-specific variables, integrates with IAM for access control, and works across all deployed versions. Credentials are separately stored in Secrets Manager, which provides additional security features. The application needs only one update to retrieve from Parameter Store.

Why the other options are wrong

  • B. AWS KMS is a key management service, not designed for storing and retrieving configuration variables; it would require multiple code updates and doesn't support the hierarchical organization needed.
  • C. Encrypted files stored with the application require code changes for each environment and complicate version management across environments.
  • D. Defining variables in ECS task definitions requires code changes for each deployment and doesn't provide a centralized management approach for current and future versions.

That was 10 of 557.

The full AWS DVA-C02 pack has all 557 questions, each with the answer, the explanation and why the other options are wrong, plus a questions-only copy for timed runs. US$39, paid once, with free monthly updates and a pass-or-your-money-back guarantee.

Get the full pack