This is the free Amazon DVA-C02 practice question bank —
280 of 553 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-08-05.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company’s developer needs to activate Amazon CloudWatch Logs Insights for an application’s AWS Lambda functions. The company uses an AWS Serverless Application Model (AWS SAM) template to deploy the application. The SAM template includes a logical resource that is named CloudWatchLogGroup.
How should the developer modify the SAM template to activate CloudWatch Logs Insights for the Lambda functions?
A. Add an output named CloudWatchinsightRule that contains a value of the Amazon Resource Name (ARN) for the CloudWatchLogGroup resource.
B. Add a parameter named CloudWatchLogGroupNamePrefix that contains a value of the application name. Reference the new parameter in the CloudWatchLogGroup resource.
C. For each Lambda function, add the layer for the Lambda Insights extension and the CloudWatchLambdaInsightsExecutionRolePolicy AWS managed policy.
D. For each Lambda function, set Tracing mode to Active and add the CloudWatchLambdaInsightsExecutionRolePolicy AWS managed policy.
Show Answer
Correct Answer: C
Explanation: The intent is to enable CloudWatch Lambda Insights (despite the wording mentioning CloudWatch Logs Insights). Enabling Lambda Insights for AWS Lambda requires adding the Lambda Insights extension layer to each function and granting the function's execution role the AWS managed policy CloudWatchLambdaInsightsExecutionRolePolicy. The other options do not enable Lambda Insights or Logs Insights functionality.
Question 2
A developer is creating a web application to upload and store private data. The application will encrypt private data and then will upload the data to an Amazon S3 bucket.
The developer needs to implement a solution to automatically find any unencrypted private data in the S3 bucket. The solution must monitor the security and access control of the S3 bucket and must provide a notification if there are any security issues.
Which solution will meet these requirements?
A. Use AWS Step Functions to run Amazon Athena queries. Configure Athena to find unencrypted private data and to monitor for security issues in the S3 bucket. Start the queries when new objects are added to the S3 bucket. Configure Athena to provide a notification if security issues are detected.
B. Enable Amazon Macie for the S3 bucket. Set up custom criteria to find unencrypted private data in the S3 bucket. Set up AWS User Notifications to provide a notification when Macie detects security issues.
C. Enable Amazon Inspector for the AWS account. Use Amazon Inspector to scan the S3 bucket to find unencrypted private data and to monitor for security issues. Set up Amazon EventBridge to provide a notification when Amazon Inspector detects security issues.
D. Create an Amazon Kinesis data stream. Configure Amazon S3 to send new object notifications to the stream. Create an AWS Lambda function that runs every 10 minutes to check the stream for unencrypted private data and to monitor for security issues. Program the Lambda function to provide a notification when security issues are detected.
Show Answer
Correct Answer: B
Explanation: Amazon Macie is the AWS service designed to discover and classify sensitive data in Amazon S3, including identifying objects that match sensitive-data criteria. It also evaluates bucket security and access settings, generating findings for security issues. Notifications can be delivered via AWS User Notifications (or EventBridge). The other options use services that are not intended for S3 sensitive data discovery and bucket security monitoring or require unnecessary custom implementation.
Question 3
A developer adds new dependencies to an existing AWS Lambda function. The developer cannot deploy the Lambda function because the unzipped deployment package exceeds the maximum size quota for the Lambda function. The instruction set architecture of the Lambda function is x86_64.
The developer must implement a solution to deploy the Lambda function with the new dependencies.
Which solution will meet these requirements?
A. Create a snapshot of all the dependencies. Configure the Lambda function to use the snapshot.
B. Change the instruction set architecture of the Lambda function to use an arm64 architecture.
C. Associate an Amazon Elastic Block Store (Amazon EBS) volume with the Lambda function. Store all the dependencies on the EBS volume.
D. Create and deploy a Lambda container image with all the dependencies.
Show Answer
Correct Answer: D
Explanation: AWS Lambda ZIP deployments have a maximum unzipped deployment package size of 250 MB. If the function and its dependencies exceed this limit, packaging the function as a Lambda container image is the supported solution, allowing images up to 10 GB. Changing the CPU architecture does not address the size limit, Lambda does not support attaching EBS volumes, and there is no feature to use dependency snapshots for deployment.
Question 4
A company has an ecommerce platform. A developer is designing an Amazon DynamoDB table to store customer order data for the platform. The table uses the order ID as the partition key.
The developer needs to modify the table to get all order IDs that are associated with a given customer email address in a single query. The solution must give the developer the ability to query order IDs by other item attributes in the future.
Which solution will meet these requirements?
A. Configure the partition key to use the customer email address as the sort key.
B. Update the table to use the customer email address as the partition key.
C. Create a local secondary index (LSI) with the customer email address as the sort key.
D. Create a global secondary index (GSI) with the customer email address as the partition key.
Show Answer
Correct Answer: D
Explanation: A global secondary index (GSI) allows a different partition key than the base table. Keeping the base table partition key as order ID preserves efficient order lookups, while a GSI with customer email as the partition key enables querying all orders for a customer in a single query. GSIs also support adding additional indexes later for other access patterns.
Question 5
A developer built an application that uses AWS Lambda functions to process images. The developer wants to improve image processing times throughout the day.
The developer needs to create an Amazon CloudWatch Logs Insights query that shows the average, slowest, and fastest processing time in 1-minute intervals.
Which query will meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: A
Explanation: AWS Lambda writes REPORT log entries that include the Duration metric. A CloudWatch Logs Insights query that filters for REPORT lines, parses the Duration value, and aggregates with avg(duration), min(duration), and max(duration) using bin(1m) provides the average, fastest, and slowest processing times in 1-minute intervals.
Question 6
A developer is building an application that stores sensitive user data. The application includes an Amazon CloudFront distribution and multiple AWS Lambda functions that handle user requests.
The user requests contain over 20 data fields. Each application transaction contains sensitive data that must be encrypted. Only specific parts of the application need to have the ability to decrypt the data.
Which solution will meet these requirements?
A. Associate the CloudFront distribution with a Lambda@Edge function. Configure the function to perform field-level asymmetric encryption by using a user-defined RSA public key that is stored in AWS Key Management Service (AWS KMS).
B. Integrate AWS WAF with CloudFront to protect the sensitive data. Use a Lambda function and self-managed keys to perform the encryption and decryption processes.
C. Configure the CloudFront distribution to use WebSockets by forwarding all viewer request headers to the origin. Create an asymmetric AWS KMS key. Configure the CloudFront distribution to use field-level encryption. Use the AWS KMS key.
D. Configure the cache behavior in the CloudFront distribution to require HTTPS for communication between viewers and CloudFront. Configure GoudFront to require users to access the files by using either signed URLs or signed cookies.
Show Answer
Correct Answer: A
Explanation: CloudFront field-level encryption is designed to encrypt sensitive fields at the edge so that only components with the corresponding private key can decrypt them. CloudFront uses uploaded RSA public keys for field-level encryption, not AWS KMS asymmetric keys directly. Option C is incorrect because CloudFront field-level encryption does not integrate directly with KMS asymmetric keys. Options B and D do not satisfy the requirement for selective field encryption and restricted decryption capability.
Question 7
A developer is designing an event-driven architecture. An AWS Lambda function that processes data needs to push processed data to a subset of four consumer Lambda functions. The data must be routed based on the value of one field in the data.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an Amazon Simple Queue Service (Amazon SQS) queue and event source mapping for each consumer Lambda function. Add message routing logic to the data-processing Lambda function.
B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the four consumer Lambda functions to the topic. Add message filtering logic to each consumer Lambda function. Subscribe the data-processing Lambda function to the SNS topic.
C. Create a separate Amazon Simple Notification Service (Amazon SNS) topic and subscription for each consumer Lambda function. Add message routing logic to the data-processing Lambda function to publish to the appropriate topic.
D. Create a single Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the four consumer Lambda functions to the topic. Add SNS subscription filter policies to each subscription. Configure the data-processing Lambda function to publish to the topic.
Show Answer
Correct Answer: D
Explanation: A single Amazon SNS topic with subscription filter policies routes messages to only the relevant Lambda subscribers based on message attributes. This keeps routing logic out of the producer and consumers, minimizes operational overhead, and uses managed SNS filtering. Options A and C require custom routing logic in the producer, while B delivers all messages to all consumers and requires each consumer to filter.
Question 8
A company has an AWS Step Functions state machine named myStateMachine. The company configured a service role for Step Functions.
The developer must ensure that only the myStateMachine state machine can assume the service role.
Which statement should the developer add to the trust policy to meet this requirement?
A.
B.
C.
D.
Show Answer
Correct Answer: A
Explanation: To ensure only a single Step Functions state machine can assume the service role, the trust policy should restrict the sts:AssumeRole permission using the aws:SourceArn condition set to the exact ARN of the myStateMachine state machine. Policies using wildcards or only the account ID are broader than required, and a policy excluding the specific ARN would have the opposite effect.
Question 9
A company uses two AWS accounts: production and development. The company stores data in an Amazon S3 bucket that is in the production account. The data is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The company plans to copy the data to another S3 bucket that is in the development account.
A developer needs to use a KMS key to encrypt the data in the S3 bucket that is in the development account. The KMS key in the development account must be accessible from the production account,
Which solution will meet these requirements?
A. Replicate the customer managed KMS key from the production account to the development account. Specify the production account in the key policy.
B. Create a new customer managed KMS key in the development account. Specify the production account in the key policy.
C. Create a new AWS managed KMS key for Amazon S3 in the development account. Specify the production account in the key policy.
D. Replicate the default AWS managed KMS key for Amazon S3 from the production account to the development account. Specify the production account in the key policy.
Show Answer
Correct Answer: B
Explanation: Use a new customer managed KMS key in the development account and allow the production account to use it through the key policy (and corresponding IAM permissions). AWS managed keys (such as aws/s3) cannot have their key policies modified for cross-account access, and KMS keys cannot be 'replicated' across accounts like this. Therefore, creating a customer managed key in the development account with cross-account permissions satisfies the requirement.
Question 10
A company has an application that runs on Amazon EC2 instances. The application needs to use dynamic feature flags that will be shared with other applications. The application must poll on an interval for new feature flag values. The values must be cached when they are retrieved.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Store the feature flag values in AWS Secrets Manager. Configure an Amazon ElastiCache node to cache the values by using a lazy loading strategy in the application. Update the application to poll for the values on an interval from ElastiCache.
B. Store the feature flag values in an Amazon DynamoDB table. Configure DynamoDB Accelerator (DAX) to cache the values by using a lazy loading strategy in the application. Update the application to poll for the values on an interval from DynamoD
C. Store the feature flag values in AWS AppConfig. Configure AWS AppConfig Agent on the EC2 instances to poll for the values on an interval. Update the application to retrieve the values from the AppConfig Agent localhost endpoint.
D. Store the feature flag values in AWS Systems Manager Parameter Store. Configure the application to poll on an interval. Configure the application to use the AWS SDK to retrieve the values from Parameter Store and to store the values in memory.
Show Answer
Correct Answer: C
Explanation: AWS AppConfig is purpose-built for dynamic configuration and feature flags. The AWS AppConfig Agent runs on the EC2 instance, polls AppConfig for updates at configured intervals, caches the configuration locally, and exposes it through a localhost endpoint. Applications read from the local agent instead of repeatedly calling the service, providing the required polling and caching with minimal operational overhead. Secrets Manager is intended for secrets, not feature flags. DynamoDB with DAX adds unnecessary infrastructure to manage for this use case. Parameter Store would require the application to implement its own polling and in-memory caching logic.
$19
Get all 553 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.