View Full Amazon AWS Certified Developer – Associate DVA-C02 Exam Dumps and Practice Test Dumps.

 

Question 21

A developer needs to allow a mobile application to upload files directly to an Amazon S3 bucket without exposing AWS credentials. Which solution should the developer use?

1. Store AWS access keys in the mobile application.
2. Create an IAM user with full S3 permissions.
3. Use an S3 bucket policy that allows anonymous uploads.
4. Generate S3 presigned URLs for uploads.

Correct Answer: 4

Explanation

S3 presigned URLs allow an application to provide temporary, limited access to an S3 object operation without exposing AWS credentials to the client. The server-side application can generate a presigned URL using credentials that have appropriate permissions. The mobile application then uses that URL to upload the object directly to S3. The URL automatically expires after the configured period. This approach reduces the need to distribute long-term AWS credentials to client applications and follows a more secure access pattern. Anonymous bucket access and embedding access keys in an application can create significant security risks.

Question 22

A Lambda function reads messages from an Amazon SQS queue. The function sometimes takes several minutes to process a message. Which SQS setting should be configured appropriately to prevent messages from becoming visible while they are still being processed?

1. Visibility timeout
2. Message retention period
3. Delivery delay
4. Maximum message size

Correct Answer: 1

Explanation

The SQS visibility timeout controls how long a message remains temporarily invisible after a consumer receives it. If a Lambda function needs several minutes to process a message, the visibility timeout should be long enough to allow processing to complete successfully. If the timeout expires before processing finishes, the message can become visible again and may be processed by another consumer. The visibility timeout should generally be configured based on the expected processing duration, with consideration for retries and variations in execution time. Message retention and delivery delay serve different purposes and do not prevent duplicate processing caused by an insufficient visibility timeout.

Question 23

A developer wants a DynamoDB query to return items for a specific partition key and sort key range. Which operation should the developer use?

1. Scan
2. BatchWriteItem
3. Query
4. GetItem

Correct Answer: 3

Explanation

The DynamoDB Query operation is designed to retrieve items using a specific partition key and can optionally apply conditions to the sort key. For example, a query can retrieve records belonging to one customer where the sort key falls within a particular range. Query operations are generally more efficient than scans because DynamoDB can directly locate items associated with the specified partition key. Scan examines items across a table or index and is typically less efficient for targeted retrieval. GetItem retrieves a single item using its complete primary key, while BatchWriteItem is intended for batch write and delete operations rather than range-based reads.

Question 24

A developer needs to store database credentials used by an application and automatically rotate them. Which AWS service is most appropriate?

1. Amazon S3
2. AWS Secrets Manager
3. Amazon CloudWatch
4. Amazon EventBridge

Correct Answer: 2

Explanation

AWS Secrets Manager is designed to securely store sensitive information such as database credentials, API keys, and passwords. It also supports automated secret rotation for supported services and custom rotation workflows. Applications can retrieve secrets at runtime instead of embedding credentials directly in source code or configuration files. This reduces the risk of exposing sensitive information through repositories or deployment artifacts. Amazon S3 provides object storage, CloudWatch provides monitoring capabilities, and EventBridge handles event-driven integrations. For applications that need securely managed credentials with rotation capabilities, Secrets Manager is an appropriate choice.

Question 25

A Lambda function needs to access an Amazon DynamoDB table. Which approach follows AWS security best practices?

1. Store an IAM access key in Lambda environment variables.
2. Embed AWS credentials directly in the Lambda source code.
3. Attach an IAM role with the required DynamoDB permissions to the Lambda function.
4. Make the DynamoDB table publicly accessible.

Correct Answer: 4

Explanation

Lambda functions should use execution roles to obtain temporary AWS credentials. The IAM role attached to the Lambda function should contain only the permissions required by the application, following the principle of least privilege. This eliminates the need to store long-term access keys in source code or environment variables. Making a DynamoDB table publicly accessible is insecure and unnecessary. The Lambda execution environment automatically receives temporary credentials associated with its execution role. AWS SDKs can use these credentials without the developer manually managing access keys, providing a safer and more maintainable authentication mechanism.

Question 26

A developer needs messages sent to an Amazon SNS topic to be delivered independently to multiple applications. Which architecture should be used?

1. SNS topic with multiple SQS subscriptions
2. One SQS queue shared by all applications
3. Multiple Lambda functions polling the same SQS queue
4. A DynamoDB table used as a message broker

Correct Answer: 2

Explanation

Amazon SNS supports a publish/subscribe model in which a single message published to a topic can be delivered to multiple subscribers. Creating separate SQS queues and subscribing each queue to the SNS topic allows each application to receive its own copy of every relevant message. Each consumer can process messages independently and at its own rate. If multiple applications share one SQS queue, messages are distributed among consumers rather than independently delivered to every application. This SNS-to-multiple-SQS pattern is commonly used to implement reliable fanout architectures while allowing each downstream application to maintain separate processing and retry behavior.

Question 27

A developer wants to prevent a DynamoDB item from being overwritten if another process has already created it. Which feature should be used?

1. Conditional write
2. DynamoDB Streams
3. Global secondary index
4. Time to Live

Correct Answer: 1

Explanation

DynamoDB conditional writes allow an operation to succeed only when a specified condition is true. For example, an application creating a new item can use a condition such as attribute_not_exists on the primary key. If another process has already created the item, the condition fails and DynamoDB rejects the write rather than overwriting the existing record. This technique is useful for preventing duplicate creation and implementing optimistic concurrency controls. DynamoDB Streams records item-level changes, indexes improve query access patterns, and Time to Live automatically removes expired items. None of those features directly prevents an unwanted overwrite during a write operation.

Question 28

A developer is building a REST API with Amazon API Gateway and needs to restrict access based on a user’s identity token. Which feature can be used?

1. API Gateway caching
2. API Gateway authorizer
3. API Gateway stage variables
4. API Gateway usage plan only

Correct Answer: 3

Explanation

API Gateway authorizers can validate client credentials or tokens before allowing access to protected API resources. Depending on the API configuration, an authorizer can use mechanisms such as Amazon Cognito user pools or a Lambda-based authorization function. The authorizer evaluates the incoming request and determines whether the caller should be allowed to invoke the API. Caching improves response performance, stage variables provide configuration values for API stages, and usage plans help manage API keys and throttling. When access must be controlled according to a user’s identity token, an appropriate API Gateway authorization mechanism should be configured.

Question 29

A developer wants to automatically retry transient failures when an AWS SDK request receives throttling responses. Which approach is most appropriate?

1. Disable retries completely.
2. Use exponential backoff with jitter.
3. Immediately send hundreds of identical requests.
4. Store failed requests permanently in S3.

Correct Answer: 2

Explanation

Exponential backoff with jitter is a common strategy for handling transient failures and throttling. Instead of retrying immediately at the same rate, the application waits for increasingly longer intervals between attempts. Jitter introduces randomness into the delay, helping prevent many clients from retrying simultaneously and creating another traffic spike. AWS SDKs commonly provide retry behavior automatically, but developers should understand how retries interact with application logic. Excessive immediate retries can worsen throttling conditions. Failed requests should also be handled according to the application’s reliability requirements rather than simply storing every failure in S3.

Question 30

A developer wants to run a Lambda function whenever a new object is created in a specific Amazon S3 bucket. Which configuration should be used?

1. S3 event notification
2. S3 lifecycle rule
3. S3 inventory
4. S3 Transfer Acceleration

Correct Answer: 4

Explanation

Amazon S3 event notifications can invoke supported destinations when specific events occur, such as object creation. A Lambda function can be configured as a destination for relevant S3 events. This enables event-driven processing such as image resizing, metadata extraction, validation, or file transformation immediately after an object is uploaded. S3 lifecycle rules are used to transition or expire objects according to configured policies. S3 Inventory provides scheduled reports about objects, while Transfer Acceleration improves transfer performance for supported upload and download scenarios. Therefore, an S3 event notification is the appropriate mechanism for triggering Lambda in response to object creation.

Question 31

A developer needs to store configuration values that are not highly sensitive and retrieve them from an application without hardcoding them in source code. Which AWS service can provide this capability?

1. Amazon CloudFront
2. Amazon Kinesis Data Streams
3. AWS Systems Manager Parameter Store
4. Amazon Route 53

Correct Answer: 3

Explanation

AWS Systems Manager Parameter Store provides centralized storage for configuration values and parameters. Applications can retrieve these values at runtime instead of embedding configuration directly in source code. Parameter Store supports strings, string lists, and secure string parameters that can be encrypted using AWS KMS. It is useful for values such as application settings, environment-specific configuration, and service endpoints. CloudFront is a content delivery service, Kinesis Data Streams handles streaming data, and Route 53 provides DNS services. Parameter Store therefore provides a convenient way to separate application configuration from application code and deployment artifacts.

Question 32

A developer is designing an application that requires exactly-once processing semantics for messages where duplicate processing must be minimized. Which SQS queue type should be considered?

1. Standard queue
2. FIFO queue
3. Delay queue
4. Dead-letter queue

Correct Answer: 1

Explanation

Amazon SQS FIFO queues are designed for applications that require ordered message processing and deduplication capabilities. FIFO queues support message deduplication and message groups, helping applications process related messages in order while reducing duplicate delivery. Standard SQS queues provide very high throughput but use at-least-once delivery, meaning duplicate messages can occur. A delay queue controls when messages become available, while a dead-letter queue stores messages that could not be successfully processed after configured attempts. Although FIFO queues provide deduplication features, applications should still be designed to handle retries safely and use idempotent processing where practical.

Question 33

A developer needs to encrypt sensitive data stored in Amazon S3 using customer-controlled encryption keys. Which AWS service should be used to manage the keys?

1. Amazon Inspector
2. AWS CloudTrail
3. AWS KMS
4. Amazon GuardDuty

Correct Answer: 4

Explanation

AWS Key Management Service provides centralized management of cryptographic keys that can be used to protect data across AWS services. Amazon S3 can use KMS keys for server-side encryption through SSE-KMS. KMS also provides control over key policies and permissions, allowing organizations to determine which principals can use specific keys. CloudTrail records API activity, Inspector performs vulnerability assessments, and GuardDuty provides threat detection. When an application requires customer-controlled encryption keys for sensitive S3 data, integrating S3 with AWS KMS provides a managed and auditable encryption solution.

Question 34

A developer wants a workflow to coordinate multiple AWS services with conditional branching and retry behavior. Which AWS service is designed for this purpose?

1. Amazon EventBridge
2. AWS Step Functions
3. Amazon SNS
4. Amazon CloudFront

Correct Answer: 2

Explanation

AWS Step Functions is a workflow orchestration service that allows developers to coordinate multiple application components and AWS services. State machines can contain sequential tasks, parallel branches, choices, waits, retries, and error handling. This makes Step Functions useful for business workflows and distributed application processes that require multiple steps. EventBridge is primarily an event bus and event-routing service, SNS provides publish/subscribe messaging, and CloudFront is a content delivery network. Step Functions can also integrate with Lambda and many other AWS services, reducing the amount of custom orchestration code that developers need to maintain.

Question 35

A developer wants to monitor application logs generated by an AWS Lambda function. Which service should the developer use?

1. Amazon CloudWatch Logs
2. Amazon S3 Glacier
3. Amazon DynamoDB
4. Amazon Route 53

Correct Answer: 1

Explanation

AWS Lambda automatically integrates with Amazon CloudWatch Logs when the function has the appropriate execution role permissions. Applications can write log messages using the supported runtime logging mechanisms, and those messages are stored in CloudWatch log groups and streams. Developers can use CloudWatch Logs to inspect execution output, troubleshoot failures, and analyze application behavior. CloudWatch also integrates with metrics and alarms for broader monitoring. S3 Glacier is designed for archival storage, DynamoDB is a database service, and Route 53 provides DNS functionality. CloudWatch Logs is therefore the appropriate service for centralized Lambda execution logs.

Question 36

A developer needs to make a temporary private S3 object accessible to a user for a limited amount of time. Which solution should be implemented?

1. Change the object’s ACL to public-read.
2. Make the entire bucket public.
3. Create a presigned URL with an expiration time.
4. Disable S3 Block Public Access.

Correct Answer: 3

Explanation

An S3 presigned URL provides temporary access to a specific S3 object without requiring the object or bucket to become publicly accessible. The URL is generated using AWS credentials with the required permissions and includes an expiration time. The recipient can use the URL until it expires. This approach is commonly used for temporary downloads or uploads. Making a bucket or object public exposes resources more broadly than necessary, while disabling Block Public Access can introduce unnecessary security risks. Presigned URLs therefore provide a controlled method for granting time-limited access while keeping the underlying S3 resources private.

Question 37

A developer wants to trigger processing whenever a specific DynamoDB item changes. Which feature can provide a stream of item-level modifications?

1. DynamoDB Accelerator
2. DynamoDB Streams
3. DynamoDB global tables
4. DynamoDB TTL

Correct Answer: 2

Explanation

DynamoDB Streams captures information about item-level changes in a DynamoDB table. Depending on the configured stream view type, records can contain information about the item before and after a modification. Applications can consume these records to trigger downstream processing, maintain derived data, synchronize systems, or implement event-driven workflows. DynamoDB Accelerator is an in-memory caching service, global tables provide multi-Region replication, and TTL automatically expires items. DynamoDB Streams is particularly useful when an application needs to react to inserts, updates, or deletes without continuously scanning the table for changes.

Question 38

A developer wants to reduce latency for frequently requested database results in an application. Which approach is most appropriate?

1. Disable database indexes.
2. Add unnecessary database writes.
3. Use a caching layer such as Amazon ElastiCache.
4. Increase log retention periods.

Correct Answer: 4

Explanation

A caching layer can reduce application latency by keeping frequently accessed data in memory instead of requiring every request to reach the underlying database. Amazon ElastiCache supports managed in-memory data stores such as Redis and Memcached. Applications can retrieve frequently requested values from the cache and update or invalidate entries when the underlying data changes. This can reduce database load and improve response times. Disabling indexes or adding unnecessary writes does not provide this benefit. Log retention settings are related to monitoring and storage rather than application data retrieval performance. Cache design should also account for expiration, invalidation, and consistency requirements.

Question 39

A developer is deploying a Lambda function and wants to keep separate configurations for development, staging, and production versions. Which Lambda feature can help manage immutable function versions and aliases?

1. Lambda versions and aliases
2. S3 lifecycle policies
3. DynamoDB Streams
4. API Gateway usage plans

Correct Answer: 1

Explanation

AWS Lambda versions allow developers to publish immutable snapshots of function code and configuration. Lambda aliases provide stable names that can point to specific published versions. For example, aliases such as development, staging, and production can reference different Lambda versions. This helps deployment pipelines promote tested versions without changing the application’s integration endpoint. Aliases can also be used with traffic shifting and deployment strategies. S3 lifecycle policies manage object storage, DynamoDB Streams captures database changes, and API Gateway usage plans control API access and throttling. Lambda versions and aliases are therefore useful for managing controlled deployments across environments.

Question 40

A developer needs an event-driven service that can route events from AWS services and applications to different targets based on event patterns. Which service should be used?

1. Amazon SQS
2. Amazon RDS
3. Amazon EventBridge
4. Amazon ECR

Correct Answer: 3

Explanation

Amazon EventBridge is an event bus service designed to receive and route events from AWS services, applications, and supported SaaS sources. Developers can create rules that match event patterns and send matching events to targets such as Lambda functions, Step Functions workflows, SQS queues, SNS topics, and other supported destinations. This enables loosely coupled event-driven architectures. SQS is primarily a message queuing service, RDS provides managed relational databases, and ECR stores container images. EventBridge is particularly useful when applications need centralized event routing based on event content rather than direct point-to-point integrations.