View Full Amazon AWS Certified Developer – Associate DVA-C02 Exam Dumps and Practice Test Dumps.

 

Question 281

A developer needs to allow an application running on an EC2 instance to access an S3 bucket without storing long-term AWS access keys on the instance. What should the developer use?

1. An S3 bucket ACL
2. An IAM user with access keys
3. An IAM role attached to the EC2 instance
4. An S3 presigned URL

Correct Answer: 3

Explanation

An IAM role attached to an EC2 instance allows applications running on the instance to obtain temporary AWS credentials automatically. The AWS SDK credential provider chain can retrieve these credentials from the instance metadata service and use them to make authorized AWS API calls. This approach avoids storing long-term access keys in application configuration files or source code. An IAM user would require managing long-term credentials, while an S3 ACL is an authorization mechanism rather than a credential provider. A presigned URL is useful for specific S3 operations but is not a general solution for application access to AWS services.

Question 282

A developer needs to prevent an IAM principal from performing an action even if another attached policy explicitly allows that action. Which policy element can enforce this behavior?

1. Explicit Deny
2. Allow
3. Resource tag
4. Permission boundary only

Correct Answer: 1

Explanation

An explicit Deny in an applicable IAM policy overrides an Allow statement for the same action. AWS evaluates policies using rules in which an explicit deny takes precedence over permissions granted by an allow. Developers can use explicit deny statements when certain operations must be prohibited regardless of broader permissions. An Allow statement grants access when no applicable deny exists. Resource tags can be used in policy conditions but do not independently override an allow. Permission boundaries limit the maximum permissions a principal can receive, but an explicit Deny remains the direct mechanism for denying a particular action.

Question 283

A developer is designing a DynamoDB table and needs to retrieve items efficiently using a non-key attribute that is frequently queried. Which feature should be considered?

1. DynamoDB Streams
2. DynamoDB TTL
3. DynamoDB global secondary index
4. DynamoDB transactions

Correct Answer: 3

Explanation

A DynamoDB global secondary index allows applications to query data using a different partition key and optional sort key from those defined on the base table. This is useful when application access patterns require efficient queries based on attributes that are not part of the table’s primary key. DynamoDB Streams capture item-level changes, TTL automatically removes expired items, and transactions provide coordinated operations across multiple items or tables. Before creating an index, developers should identify the required access pattern and consider index storage and capacity requirements. A GSI is appropriate when efficient access through an alternate key is required.

Question 284

A developer needs to retrieve a secret from AWS Secrets Manager in a Lambda function. Where should the application retrieve the secret?

1. From the Lambda source code
2. At runtime using the AWS SDK
3. From a hard-coded environment variable
4. From a public S3 object

Correct Answer: 2

Explanation

Applications can retrieve secrets from AWS Secrets Manager at runtime using the AWS SDK. This avoids embedding sensitive credentials directly in source code or distributing them as static configuration values. The Lambda execution role should have only the permissions required to retrieve the necessary secret. Secrets Manager can also support rotation, helping applications use updated credentials without changing source code. Hard-coded credentials and public storage expose sensitive information unnecessarily. Runtime retrieval through the SDK therefore provides a secure and flexible pattern for accessing secrets while maintaining centralized secret management.

Question 285

A developer wants to configure an S3 event notification so that a Lambda function runs only when objects with a specific file extension are created. Which configuration can help achieve this?

1. S3 event notification prefix and suffix filters
2. DynamoDB conditional writes
3. CloudWatch alarm thresholds
4. Lambda reserved concurrency

Correct Answer: 1

Explanation

Amazon S3 event notifications support filtering based on object key prefixes and suffixes. A developer can configure a suffix such as .jpg or .json so that notifications are generated only for objects matching the required pattern. This can reduce unnecessary Lambda invocations when a bucket contains different types of objects. DynamoDB conditional writes are unrelated to S3 event filtering, CloudWatch alarms monitor metrics, and Lambda reserved concurrency controls concurrent executions. Prefix and suffix filters are therefore useful when an application needs to trigger processing only for specific categories of uploaded S3 objects.

Question 286

A developer is using DynamoDB in an application with unpredictable traffic and wants to avoid manually provisioning read and write capacity. Which capacity mode should be selected?

1. Provisioned capacity
2. On-demand capacity
3. Reserved capacity
4. Burst-only capacity

Correct Answer: 2

Explanation

DynamoDB on-demand capacity mode is designed for applications with unpredictable or rapidly changing traffic patterns. Instead of requiring developers to configure a fixed amount of read and write capacity, DynamoDB automatically handles capacity according to application usage and charges based on requests. Provisioned capacity is more appropriate when traffic patterns are predictable and capacity can be planned. DynamoDB does not provide a general burst-only capacity mode. For workloads where traffic is difficult to forecast and minimizing capacity management is important, on-demand capacity provides a suitable operational model.

Question 287

A developer performs a DynamoDB Query operation and receives a LastEvaluatedKey. What does this indicate?

1. The table is encrypted incorrectly
2. The query failed permanently
3. Additional matching items may be available
4. The item was automatically deleted

Correct Answer: 3

Explanation

When a DynamoDB Query or Scan operation returns a LastEvaluatedKey, it indicates that the response may not contain all matching items. The application can use that key as ExclusiveStartKey in a subsequent request to continue retrieving results. This mechanism supports pagination and helps applications process large result sets without requiring the entire dataset in a single response. A LastEvaluatedKey does not indicate an encryption problem or permanent query failure. It also does not mean that an item was deleted. Developers should continue querying when additional results are required.

Question 288

A developer needs to configure an API Gateway API so that invalid request parameters are rejected before the request reaches the backend integration. Which feature can help?

1. API Gateway request validation
2. S3 Object Lock
3. DynamoDB TTL
4. CloudFront invalidation

Correct Answer: 1

Explanation

API Gateway request validation can verify aspects of incoming requests before forwarding them to the backend integration. Depending on the API configuration, validation can check request parameters and request bodies against defined models or requirements. Rejecting invalid requests at the API layer can reduce unnecessary backend processing and help maintain consistent API behavior. S3 Object Lock protects objects from deletion or modification during retention periods, DynamoDB TTL removes expired records, and CloudFront invalidation removes cached content. Request validation is therefore the relevant API Gateway capability for rejecting malformed or incomplete requests early.

Question 289

A developer wants an SNS topic to deliver a message only to subscribers whose attributes match specific values. Which feature should be configured?

1. SNS message filtering policies
2. SQS visibility timeout
3. Lambda reserved concurrency
4. S3 lifecycle rules

Correct Answer: 1

Explanation

Amazon SNS message filtering policies allow subscribers to receive only messages that match specified message attributes or filtering criteria. This reduces unnecessary message delivery and allows different subscribers to process only the events relevant to them. For example, subscribers can filter messages based on event type, application environment, or another published attribute. SQS visibility timeout controls how long a received message remains hidden from other consumers, while Lambda reserved concurrency limits concurrent executions. S3 lifecycle rules manage object transitions and expiration. SNS filtering policies are therefore appropriate for selective message delivery.

Question 290

A developer needs to replay previously received events after fixing an application bug. Which EventBridge feature can support this requirement?

1. EventBridge archive and replay
2. API Gateway throttling
3. S3 Versioning
4. DynamoDB TTL

Correct Answer: 1

Explanation

Amazon EventBridge supports event archives that can retain selected events for later use. Developers can replay archived events to event buses after application changes or during testing and recovery scenarios. This can be useful when a consumer needs to reprocess historical events without requiring the original event producer to generate them again. API Gateway throttling controls API request rates, S3 Versioning maintains object versions, and DynamoDB TTL removes expired items. EventBridge archive and replay therefore provides the functionality required to retain and reprocess selected historical events.

Question 291

A developer is creating a Step Functions workflow and needs the workflow to pause for a specified amount of time before continuing. Which state type should be used?

1. Task
2. Choice
3. Wait
4. Parallel

Correct Answer: 3

Explanation

The Step Functions Wait state pauses workflow execution for a specified duration or until a specified timestamp. It is useful for workflows that need to delay an action without keeping a compute resource continuously running. A Task state performs work by invoking a service or compute operation, a Choice state evaluates conditions and selects a path, and a Parallel state executes multiple branches concurrently. The Wait state is therefore the appropriate choice when a workflow needs to pause before continuing. This can be useful for scheduled follow-up actions, delayed processing, and time-based business workflows.

Question 292

A developer needs a Step Functions workflow to choose different execution paths based on the value of an input field. Which state should be used?

1. Choice
2. Wait
3. Pass
4. Succeed

Correct Answer: 1

Explanation

The Step Functions Choice state allows a workflow to evaluate conditions and select one of multiple execution paths. For example, a workflow can inspect an order status and route processing differently depending on whether the status is approved, rejected, or pending. A Wait state pauses execution, a Pass state passes input to the next state without performing external work, and a Succeed state ends a successful workflow execution. The Choice state is therefore appropriate when application logic requires branching based on input data or other evaluated conditions.

Question 293

A developer is designing a Kinesis Data Streams application and wants records with the same partition key to be processed in order. Which concept provides this behavior?

1. S3 object version
2. Kinesis partition key
3. Lambda layer
4. API Gateway stage

Correct Answer: 2

Explanation

A Kinesis partition key determines the shard to which a record is routed. Records using the same partition key are directed to the same shard, where ordering is maintained for records from that partition key. This allows applications to preserve ordering for related events, such as events belonging to the same customer or device. S3 object versions, Lambda layers, and API Gateway stages address different requirements. Developers should select partition keys carefully to distribute traffic effectively across shards while maintaining the required ordering characteristics for related records.

Question 294

A developer wants CloudWatch Logs to automatically remove log data after a defined number of days to control storage costs. Which setting should be configured?

1. Log group retention
2. Lambda timeout
3. API Gateway throttling
4. SQS delay

Correct Answer: 1

Explanation

CloudWatch Logs log groups support retention settings that determine how long log events are retained. Developers can configure an appropriate retention period instead of keeping logs indefinitely. After the configured retention period, eligible log events are automatically deleted. This helps organizations manage storage costs and align log retention with operational and compliance requirements. Lambda timeout controls the maximum execution duration of a function, API Gateway throttling limits request rates, and SQS delay controls when messages become available. Log group retention is therefore the appropriate CloudWatch configuration for automatic log expiration.

Question 295

A developer wants an application to publish custom application-level metrics to CloudWatch. Which approach should be used?

1. CloudWatch custom metrics
2. S3 Inventory
3. DynamoDB Streams
4. ECR lifecycle policy

Correct Answer: 1

Explanation

CloudWatch custom metrics allow applications to publish measurements that are not automatically provided by AWS services. Developers can use the AWS SDK or supported monitoring mechanisms to publish values such as application-specific counters, processing durations, business events, or queue-related measurements. These metrics can then be visualized and used with alarms or dashboards. S3 Inventory provides object metadata reports, DynamoDB Streams capture table changes, and ECR lifecycle policies manage container image retention. CloudWatch custom metrics are therefore appropriate when an application needs to monitor measurements specific to its own behavior.

Question 296

A developer wants to reduce the number of database queries made by an application by storing frequently accessed data temporarily in memory. Which pattern should be implemented?

1. Caching
2. Sharding only
3. Object locking
4. Dead-letter processing

Correct Answer: 1

Explanation

Caching stores frequently accessed data in a faster temporary storage layer so that repeated requests do not always require access to the primary database. Services such as Amazon ElastiCache can support application caching with low-latency data access. A cache can reduce database load and improve response times when data can safely be reused for a defined period. Sharding distributes data or workload across partitions, object locking protects stored objects, and dead-letter processing handles failed messages. Caching is therefore the appropriate application pattern for reducing repeated database reads for frequently requested data.

Question 297

A developer wants to deploy a new version of an application using AWS CodeDeploy while keeping the old version available until the new version is verified. Which deployment approach supports this pattern?

1. Blue/green deployment
2. Permanent single-version deployment
3. Manual DNS deletion
4. S3 lifecycle transition

Correct Answer: 1

Explanation

A blue/green deployment maintains separate environments for the current and new application versions. The new environment can be deployed and tested before traffic is shifted from the existing environment. If the new version has problems, traffic can potentially be returned to the previous environment. This approach can reduce deployment risk and simplify rollback compared with directly replacing the existing environment. S3 lifecycle transitions manage object storage classes, while DNS deletion and manual deployment do not provide a structured application deployment strategy. Blue/green deployment is therefore appropriate when keeping the existing version available during validation is required.

Question 298

A developer builds a container image for an ECS application and needs a managed AWS registry to store the image before deployment. Which service should be used?

1. Amazon ECR
2. Amazon SQS
3. Amazon SNS
4. Amazon Route 53

Correct Answer: 1

Explanation

Amazon Elastic Container Registry, or ECR, is a managed container image registry that integrates with AWS services such as ECS and EKS. Developers can push container images to ECR and reference those images from deployment configurations. ECR supports private repositories and integrates with AWS identity and access management. SQS provides message queuing, SNS provides publish/subscribe messaging, and Route 53 provides DNS and domain-related services. ECR is therefore the appropriate service for storing container images that will be used by an ECS application.

Question 299

A developer wants to protect a Lambda function from being invoked directly by unauthorized AWS principals while allowing a specific AWS service to invoke it. Which mechanism should be configured?

1. Lambda resource-based policy
2. S3 lifecycle rule
3. DynamoDB TTL
4. CloudWatch dashboard

Correct Answer: 1

Explanation

Lambda resource-based policies control which AWS accounts, services, or principals are permitted to invoke a Lambda function. They are commonly used when granting another AWS service permission to invoke a function or when allowing cross-account invocation. The function’s execution role controls what the Lambda function can do after it starts running, while the resource-based policy controls who or what can invoke it. S3 lifecycle rules, DynamoDB TTL, and CloudWatch dashboards do not provide invocation authorization. A Lambda resource-based policy is therefore appropriate for controlling permitted invocation sources.

Question 300

A developer wants an application to obtain temporary AWS credentials for accessing resources in another AWS account without creating a long-term IAM user in that account. Which AWS service capability should be used?

1. Amazon Cognito User Pool
2. AWS STS AssumeRole
3. S3 Versioning
4. CloudWatch Logs

Correct Answer: 2

Explanation

AWS Security Token Service, or STS, provides temporary security credentials that can be used to access AWS resources. The AssumeRole operation allows an authorized principal to assume an IAM role, including a role in another AWS account when the appropriate trust and permissions are configured. The resulting temporary credentials include an access key, secret access key, and session token with a limited lifetime. Cognito User Pools manage application users, S3 Versioning preserves object versions, and CloudWatch Logs stores log data. STS AssumeRole is therefore appropriate for securely obtaining temporary cross-account AWS credentials.