CertifyDeckCargando contenido…
DVA-C02 · Sample questions
10 real questions from the CertifyDeck DVA-C02 bank, spread across the domains of the official AWS Certified Developer - Associate skills outline, with the correct answer and a full explanation of why the other options are wrong. They are original questions written from the public syllabus, not exam dumps, and they are the same style you will find in the practice tests and mock exams.
Correct answer: C. Create a COGNITO_USER_POOLS authorizer and have the app send the user pool token in the Authorization header.
A REST API authorizer of type COGNITO_USER_POOLS lets API Gateway validate the identity or access token that the client sends, typically in the Authorization header, without any custom code. AWS_IAM authorization requires requests signed with AWS credentials, not a user pool token. An API key identifies a client for usage plans and is not proof of user authentication, and a resource policy based on the caller's origin does not validate any token.
Correct answer: A. Store the credentials in AWS Secrets Manager and turn on automatic rotation for the secret.
Secrets Manager is the service AWS recommends for database credentials and provides automatic rotation with native database integrations, updating both the secret and the database. Parameter Store has no credential rotation, so a SecureString parameter would need a custom script that the team must build and run. KMS key rotation changes the key material that protects the ciphertext, not the database password itself.
Correct answer: C. Assume a shared role with a TenantID session tag and match dynamodb:LeadingKeys to ${aws:PrincipalTag/TenantID}.
The dynamodb:LeadingKeys condition key restricts access to items whose partition key matches a value, and referencing ${aws:PrincipalTag/TenantID} lets one role serve every tenant because the tenant ID arrives as a session tag when the role is assumed. A role per tenant also isolates the data but fails the requirement to avoid creating roles for each tenant. dynamodb:Attributes limits which attributes can be accessed, not which items, and filtering in code gives no IAM-level enforcement.
Correct answer: C. Have the Lambda function use the AWS SDK to create a presigned URL for a PUT and return it to the app.
A presigned URL lets someone upload an object without having AWS security credentials or permissions of their own; it is limited by the permissions of the identity that created it and is valid only until it expires, and the client sends the file straight to S3 with an HTTP PUT. Routing every photo through API Gateway and Lambda works functionally but fails the requirement that files bypass the backend. Embedding IAM user keys puts long-term credentials in the app, and a bucket policy open to any principal lets anyone write to the bucket.
Correct answer: B. Deploy the stack to a test environment in AWS and run integration tests against the deployed resources.
Local testing does not validate everything, such as permissions between resources in the cloud; tests that run against a deployed test environment cover security policies and configuration, and tools such as sam remote invoke or sam sync help with that workflow. Environment variables, mocks and extra sample events all keep the tests local or simulated, so the IAM problem would still go undetected.
Correct answer: A. Add a random suffix to the date, and query each suffix in the job and merge results.
Write sharding with a random suffix, such as the date followed by a number in a fixed range, spreads the writes of each day across many partition key values; the trade-off is that the reader must query every suffix and merge the results, which fits a job that reads whole days. A local secondary index keeps the same partition key, and a creation time rounded to the hour still sends all current writes to a single value.
Correct answer: B. Run aws cloudformation package to upload the local artifacts to S3, then deploy the template it returns.
The aws cloudformation package command uploads local artifacts referenced in properties such as Code of AWS::Lambda::Function and BodyS3Location of AWS::ApiGateway::RestApi to an S3 bucket and returns a copy of the template with the S3 locations, which is then deployed. CloudFormation itself works with artifacts in S3, not with paths on the build machine, so deploying or creating a change set from the raw template does not upload the files. Validating a template checks its syntax and uploads nothing.
Correct answer: A. Create a change set from the modified template, review it, and execute it only if the changes are acceptable.
A change set lets the team preview how proposed changes affect running resources, including whether resources will be added, modified, deleted or replaced, and CloudFormation changes the stack only when the change set is executed. Disabling rollback applies the changes first, so it does not provide a preview. validate-template only checks that the template is valid JSON or YAML, and a stack policy blocks updates to protected resources without reporting the planned changes.
Correct answer: C. Set MaximumConcurrency in the scaling configuration of the event source mapping for the low-priority queue.
Maximum concurrency is an event source-level setting: each SQS event source mapped to a function can have its own value, which prevents one queue from using all of the function's concurrency. Reserved concurrency applies to the whole function, so setting it to the low-priority cap would also limit the high-priority queue. Provisioned concurrency pre-initializes environments to reduce cold starts but does not cap a queue, and a smaller batch size can increase the number of invocations instead of limiting them.
Correct answer: C. Add method.request.header.X-Tenant-Id to the cache key parameters of the method integration.
API Gateway can use method or integration parameters, including custom headers, as cache keys, and caches the responses for each key value separately, so adding the tenant header to the cache key parameters keeps one cached response per tenant. Flushing the cache or shortening the TTL only reduces how long a wrong response is served. Sending Cache-Control: max-age=0 makes every request bypass and replace the cached entry, which defeats the purpose of the cache.
Answer each question before opening the explanation, and write down why you discarded the other options. On DVA-C02, most mistakes come from choosing an option that is technically possible but does not meet every requirement in the scenario.
These 10 questions are a taste of the format, not a diagnostic. To know which domains you fail, practice by domain for free and take a timed mock exam that mirrors the official weights and duration.
Start for free, no sign-up or card. Every question includes an explanation like the ones above, and the mock exam reproduces the official DVA-C02 format.