View Full Amazon AWS Certified Developer – Associate DVA-C02 Exam Dumps and Practice Test Dumps.

 

Question 81

A developer needs to grant temporary AWS permissions to an application without creating long-term IAM user credentials. Which AWS service should be used?

1. Amazon Cognito
2. Amazon S3
3. AWS KMS
4. AWS Security Token Service (STS)

Correct Answer: 4

Explanation

AWS Security Token Service (STS) provides temporary security credentials that applications and users can use to access AWS resources. These credentials include an access key ID, secret access key, and session token and have a limited lifetime. STS is commonly used with IAM roles to provide temporary permissions without distributing long-term credentials. This approach is useful for cross-account access, federated identities, and applications that need temporary AWS permissions. Amazon Cognito can manage application identities, S3 provides object storage, and KMS manages encryption keys. STS is therefore appropriate when temporary AWS credentials are required.

Question 82

A developer wants to prevent a DynamoDB update from occurring unless an item has a specific expected value. Which feature should be used?

1. DynamoDB Streams
2. ConditionExpression
3. ProjectionExpression
4. FilterExpression

Correct Answer: 2

Explanation

A DynamoDB ConditionExpression allows an application to specify a condition that must be satisfied before a write operation is completed. For example, an application can update an item only when its current version attribute matches an expected value. If the condition is false, DynamoDB rejects the operation. This is useful for implementing optimistic locking and preventing unintended overwrites. ProjectionExpression controls which attributes are returned, while FilterExpression filters query or scan results after the read operation. DynamoDB Streams records item changes. ConditionExpression is therefore the appropriate feature for validating an item’s state before modifying it.

Question 83

A developer wants to upload objects to an S3 bucket from an application while keeping the bucket private. Which approach is appropriate?

1. Use a presigned URL.
2. Make the bucket publicly writable.
3. Disable all S3 access controls.
4. Give every application user an IAM administrator account.

Correct Answer: 1

Explanation

An S3 presigned URL provides temporary access to an S3 object operation while allowing the underlying bucket to remain private. A trusted application can generate a URL using credentials that have the required permissions, and the client can then use that URL to upload an object. The URL can be configured with an expiration period, limiting how long it remains valid. Publicly writable buckets introduce significant security risks, while giving users administrator permissions violates least-privilege principles. Presigned URLs are therefore a practical solution for securely allowing clients to upload files without exposing long-term AWS credentials.

Question 84

A developer wants to process a large number of messages independently and asynchronously. Which AWS service is designed primarily for message queuing?

1. Amazon SNS
2. Amazon EventBridge
3. Amazon SQS
4. Amazon CloudFront

Correct Answer: 3

Explanation

Amazon Simple Queue Service (SQS) is a managed message queuing service designed for asynchronous communication between application components. Producers can place messages into a queue, while consumers process them independently. This helps decouple application components and allows consumers to process messages at their own rate. SQS supports standard and FIFO queue types for different workload requirements. SNS is primarily a publish/subscribe service, EventBridge provides event routing, and CloudFront is a content delivery service. SQS is therefore the appropriate choice when an application needs a durable queue between producers and consumers.

Question 85

A developer is building a Lambda function that needs configuration values that vary between environments. Which feature can store these values without changing the function code?

1. Lambda layers
2. Environment variables
3. Lambda destinations
4. Lambda aliases only

Correct Answer: 2

Explanation

Lambda environment variables allow developers to provide configuration values to a function without embedding those values directly in source code. Different environments can use different values for settings such as API endpoints, feature flags, or application configuration. Environment variables are available to the function during execution through the runtime environment. Sensitive information should generally be stored in services such as Secrets Manager or Parameter Store rather than plain environment variables. Lambda layers are intended for shared dependencies, destinations handle asynchronous invocation results, and aliases reference published function versions. Environment variables are therefore useful for environment-specific application configuration.

Question 86

A developer wants to automatically route application events to different targets based on the contents of each event. Which service should be used?

1. Amazon S3
2. Amazon RDS
3. Amazon ECR
4. Amazon EventBridge

Correct Answer: 4

Explanation

Amazon EventBridge allows applications and AWS services to publish events to an event bus. Rules can evaluate event patterns and route matching events to different targets. For example, events can be sent to Lambda functions, SQS queues, SNS topics, or Step Functions workflows based on event attributes. This enables loosely coupled event-driven architectures. S3 provides object storage, RDS provides relational database capabilities, and ECR stores container images. EventBridge is particularly useful when routing decisions depend on the content of events and multiple independent consumers need to respond to different event types.

Question 87

A developer wants to ensure that only an application with a specific IAM role can read objects from an S3 bucket. Which configuration should be used?

1. An S3 bucket policy that grants access to the required IAM role.
2. Public-read access on the bucket.
3. Anonymous access through an S3 website endpoint.
4. A CloudFront distribution without access controls.

Correct Answer: 1

Explanation

An S3 bucket policy can specify which IAM principals are allowed to perform actions on objects in the bucket. The policy can grant the required permissions specifically to an IAM role while keeping the bucket private. This supports the principle of least privilege by limiting access to the intended application identity. Public-read permissions would expose the objects to unauthenticated users and should not be used when private access is required. CloudFront does not automatically provide authorization to S3 objects. A targeted bucket policy combined with appropriate IAM permissions is therefore a suitable solution.

Question 88

A developer wants to execute several steps in a business workflow and retry a failed step automatically before continuing. Which AWS service is most suitable?

1. Amazon SQS
2. Amazon SNS
3. AWS Step Functions
4. Amazon Route 53

Correct Answer: 3

Explanation

AWS Step Functions provides workflow orchestration for applications that require multiple coordinated steps. A state machine can define sequential tasks, parallel execution, conditional branching, waiting periods, retries, and error handling. Developers can configure retry behavior for specific failures and define what should happen when a task succeeds or fails. SQS provides asynchronous message queuing, SNS provides publish/subscribe messaging, and Route 53 provides DNS services. Step Functions is therefore well suited to business processes that require multiple stages and controlled error handling across AWS services or application components.

Question 89

A developer wants to store a container image used by an Amazon ECS application. Which AWS service should be used?

1. Amazon SQS
2. Amazon CloudWatch
3. Amazon DynamoDB
4. Amazon Elastic Container Registry (ECR)

Correct Answer: 4

Explanation

Amazon Elastic Container Registry (ECR) is a managed container image registry that allows developers to store, manage, and retrieve container images. ECS tasks can pull container images from ECR when deploying containerized applications. ECR integrates with AWS identity and access management and supports image lifecycle management capabilities. SQS is a messaging service, CloudWatch provides monitoring, and DynamoDB is a NoSQL database. Using ECR allows container images to be centrally managed and securely retrieved by container workloads according to the permissions configured for the application.

Question 90

A developer wants to improve the reliability of an application that occasionally receives throttling errors from AWS services. What should the application implement?

1. Exponential backoff and retry logic
2. Unlimited immediate retries
3. Disable all error handling
4. Permanently stop after the first throttling response

Correct Answer: 1

Explanation

Exponential backoff allows an application to wait progressively longer between retry attempts after receiving transient failures such as throttling. Adding jitter to the delays can further reduce synchronized retry bursts from multiple clients. AWS SDKs commonly provide built-in retry behavior, but application developers should still understand retry settings and ensure that operations can safely be repeated. Unlimited immediate retries can increase the load on an already throttled service and make the problem worse. Proper retry handling improves resilience while preventing unnecessary request storms. Idempotency should also be considered for operations that may produce side effects.

Question 91

A developer needs to retrieve multiple known items from DynamoDB in a single API request. Which operation should be considered?

1. Scan
2. BatchGetItem
3. Query
4. UpdateItem

Correct Answer: 2

Explanation

DynamoDB BatchGetItem allows an application to retrieve multiple items from one or more DynamoDB tables using their primary keys in a single request. It is useful when the application already knows the keys of multiple required items. Query is designed to retrieve multiple items associated with a partition key and optional sort-key conditions. Scan examines items across a table or index, while UpdateItem modifies an existing item. BatchGetItem can reduce the number of individual API calls, although applications must still handle unprocessed keys and DynamoDB request limits appropriately.

Question 92

A developer wants to receive notifications when a CloudWatch metric exceeds a configured threshold. Which feature should be used?

1. CloudFormation stack
2. S3 event notification
3. CloudWatch alarm
4. DynamoDB stream

Correct Answer: 3

Explanation

Amazon CloudWatch alarms monitor metrics and can change state when a metric crosses a configured threshold. An alarm can then perform actions such as sending notifications through Amazon SNS or triggering supported automated responses. For example, a developer could configure an alarm for a high Lambda error count or excessive API latency. CloudFormation manages infrastructure, S3 event notifications respond to S3 events, and DynamoDB Streams capture database changes. A CloudWatch alarm is therefore the appropriate feature when an application needs to monitor a metric and notify operators when the metric reaches an undesirable level.

Question 93

A developer wants to create an IAM policy that allows a Lambda function to read only objects from one specific S3 bucket. Which principle should be followed?

1. Least privilege
2. Full administrator access
3. Public access
4. Root-user access

Correct Answer: 1

Explanation

The principle of least privilege means granting an identity only the permissions required to perform its intended tasks. For a Lambda function that only needs to read objects from one S3 bucket, the IAM policy should restrict permissions to the required S3 read actions and appropriate resources. Granting administrator access would provide unnecessary privileges and increase the potential impact of a compromised function. Public access and root-user credentials are also inappropriate for this use case. Applying least privilege improves security and makes permissions easier to audit and maintain as applications evolve.

Question 94

A developer wants to deploy infrastructure consistently across development, testing, and production environments. Which approach is most appropriate?

1. Manually create every resource in the console.
2. Store resource settings in application comments.
3. Configure each environment independently without templates.
4. Use AWS CloudFormation templates.

Correct Answer: 4

Explanation

AWS CloudFormation enables developers to define infrastructure as code through templates. The same template or parameterized template can be used to create consistent resources across multiple environments. This reduces configuration drift and makes infrastructure deployments repeatable. Templates can define resources, dependencies, policies, and configuration values. Manual console configuration can result in inconsistent environments and is harder to reproduce. By managing infrastructure through CloudFormation, development teams can automate deployments and maintain a version-controlled representation of the desired infrastructure state.

Question 95

A developer needs to distribute a web application’s static content globally with reduced latency. Which AWS service should be used?

1. Amazon RDS
2. Amazon DynamoDB
3. Amazon CloudFront
4. Amazon SQS

Correct Answer: 3

Explanation

Amazon CloudFront is a content delivery network that distributes content through edge locations closer to end users. It can cache static assets such as images, JavaScript files, CSS, and other web content, reducing latency for users who are geographically distant from the origin. CloudFront can use origins such as S3 buckets or HTTP servers. RDS provides relational databases, DynamoDB provides NoSQL storage, and SQS provides messaging. CloudFront is therefore appropriate when an application needs global content distribution and improved performance for users across different geographic locations.

Question 96

A developer wants to create a DynamoDB transaction that either updates multiple related items successfully or does not apply any of the updates. Which feature should be used?

1. DynamoDB Streams
2. DynamoDB transactions
3. DynamoDB TTL
4. DynamoDB Scan

Correct Answer: 2

Explanation

DynamoDB transactions provide coordinated, all-or-nothing operations across multiple items and tables. This is useful when several related writes must succeed together to maintain application consistency. If a transaction cannot complete successfully, the changes are not partially applied according to the transaction’s atomic behavior. Streams capture changes after they occur, TTL handles expiration, and Scan retrieves items across a table or index. Transactions are therefore appropriate for workloads such as transferring application state between records or updating several related entities where partial completion could produce inconsistent results.

Question 97

A developer wants to monitor the execution duration and error rate of a Lambda function. Which service provides the required monitoring metrics?

1. Amazon ECR
2. Amazon CloudWatch
3. Amazon Route 53
4. Amazon Cognito

Correct Answer: 2

Explanation

Amazon CloudWatch provides metrics for AWS Lambda functions, including invocation count, duration, errors, throttles, and other execution information. Developers can use these metrics to understand application behavior and create alarms for operational conditions. CloudWatch Logs can also capture function output for troubleshooting. ECR is used for container image storage, Route 53 provides DNS services, and Cognito manages application identities. CloudWatch is therefore the appropriate monitoring service for Lambda performance and reliability metrics. Combining metrics, logs, and alarms can provide a more complete view of application operation.

Question 98

A developer wants to prevent an S3 object from being accidentally deleted for a defined retention period. Which S3 feature should be considered?

1. S3 Object Lock
2. S3 Transfer Acceleration
3. S3 Select
4. S3 Inventory

Correct Answer: 1

Explanation

Amazon S3 Object Lock can help prevent objects from being deleted or overwritten during a configured retention period. It supports retention modes that provide different levels of protection and can be useful for workloads requiring immutable data or regulatory retention. Object Lock works with versioned S3 buckets and can help protect important records from accidental or unauthorized deletion. Transfer Acceleration is intended to improve data transfer performance, S3 Select retrieves selected object data, and Inventory provides object reports. When object immutability or retention protection is required, S3 Object Lock is the relevant feature.

Question 99

A developer wants to reduce the time required to initialize a Lambda function when it is invoked frequently. Which approach can help reduce initialization overhead?

1. Increase SQS retention.
2. Disable CloudWatch logging.
3. Reuse initialized resources outside the Lambda handler.
4. Create a new database connection for every invocation.

Correct Answer: 3

Explanation

Lambda functions can improve performance by initializing reusable resources outside the handler when appropriate. For example, a database client or AWS SDK client can be created during the initialization phase and reused across subsequent invocations when the execution environment remains available. This can reduce repeated connection setup and initialization overhead. Developers should avoid creating expensive resources unnecessarily during every invocation. Disabling logging does not directly solve initialization overhead, and creating a new database connection for every request can increase latency and resource consumption. Resource reuse should be implemented carefully while considering connection limits, timeouts, and application behavior.

Question 100

A developer needs to allow an application to access AWS services using credentials without embedding long-term access keys in the application code. Which approach should be preferred?

1. Store the root account credentials in the application.
2. Use IAM roles and temporary credentials.
3. Put access keys in a public configuration file.
4. Use the same administrator credentials for every application.

Correct Answer: 2

Explanation

IAM roles provide applications with temporary credentials without requiring developers to embed long-term AWS access keys in source code. Depending on the compute environment, AWS services can automatically provide temporary role credentials to applications through the appropriate credential provider mechanism. This approach improves security and supports the principle of least privilege because each application can receive only the permissions it requires. Root credentials and shared administrator credentials should never be used for application workloads. Keeping long-term credentials out of source code also reduces the risk of accidental exposure through repositories, logs, or deployment artifacts.