This is the free Amazon DVA-C02 practice question bank —
280 of 555 total questions, each with a full explanation, free to
read with no signup required. Updated 2026-04-24.
Every answer is verified against official Amazon documentation —
see our methodology.
Question 1
A company’s developer needs to activate Amazon CloudWatch Logs Insights for an application’s AWS Lambda functions. The company uses an AWS Serverless Application Model (AWS SAM) template to deploy the application. The SAM template includes a logical resource that is named CloudWatchLogGroup.
How should the developer modify the SAM template to activate CloudWatch Logs Insights for the Lambda functions?
A. Add an output named CloudWatchinsightRule that contains a value of the Amazon Resource Name (ARN) for the CloudWatchLogGroup resource.
B. Add a parameter named CloudWatchLogGroupNamePrefix that contains a value of the application name. Reference the new parameter in the CloudWatchLogGroup resource.
C. For each Lambda function, add the layer for the Lambda Insights extension and the CloudWatchLambdaInsightsExecutionRolePolicy AWS managed policy.
D. For each Lambda function, set Tracing mode to Active and add the CloudWatchLambdaInsightsExecutionRolePolicy AWS managed policy.
Show Answer
Correct Answer: C
Explanation: CloudWatch Logs Insights for Lambda requires CloudWatch Lambda Insights to be enabled. This is done by adding the Lambda Insights extension layer to each Lambda function and attaching the CloudWatchLambdaInsightsExecutionRolePolicy managed policy to the function’s execution role. The other options do not enable Lambda Insights or Logs Insights functionality.
Question 2
A developer is creating a web application to upload and store private data. The application will encrypt private data and then will upload the data to an Amazon S3 bucket.
The developer needs to implement a solution to automatically find any unencrypted private data in the S3 bucket. The solution must monitor the security and access control of the S3 bucket and must provide a notification if there are any security issues.
Which solution will meet these requirements?
A. Use AWS Step Functions to run Amazon Athena queries. Configure Athena to find unencrypted private data and to monitor for security issues in the S3 bucket. Start the queries when new objects are added to the S3 bucket. Configure Athena to provide a notification if security issues are detected.
B. Enable Amazon Macie for the S3 bucket. Set up custom criteria to find unencrypted private data in the S3 bucket. Set up AWS User Notifications to provide a notification when Macie detects security issues.
C. Enable Amazon Inspector for the AWS account. Use Amazon Inspector to scan the S3 bucket to find unencrypted private data and to monitor for security issues. Set up Amazon EventBridge to provide a notification when Amazon Inspector detects security issues.
D. Create an Amazon Kinesis data stream. Configure Amazon S3 to send new object notifications to the stream. Create an AWS Lambda function that runs every 10 minutes to check the stream for unencrypted private data and to monitor for security issues. Program the Lambda function to provide a notification when security issues are detected.
Show Answer
Correct Answer: B
Explanation: Amazon Macie is purpose-built to automatically discover and classify sensitive data in Amazon S3, including detecting unencrypted objects and identifying security and access control issues. Macie continuously monitors S3 buckets, generates findings for encryption and exposure risks, and integrates with AWS notifications (such as EventBridge and User Notifications) to alert on security issues. The other options require significant custom development or use services not designed for S3 data classification and encryption monitoring.
Question 3
A developer adds new dependencies to an existing AWS Lambda function. The developer cannot deploy the Lambda function because the unzipped deployment package exceeds the maximum size quota for the Lambda function. The instruction set architecture of the Lambda function is x86_64.
The developer must implement a solution to deploy the Lambda function with the new dependencies.
Which solution will meet these requirements?
A. Create a snapshot of all the dependencies. Configure the Lambda function to use the snapshot.
B. Change the instruction set architecture of the Lambda function to use an arm64 architecture.
C. Associate an Amazon Elastic Block Store (Amazon EBS) volume with the Lambda function. Store all the dependencies on the EBS volume.
D. Create and deploy a Lambda container image with all the dependencies.
Show Answer
Correct Answer: D
Explanation: The unzipped Lambda ZIP deployment package exceeds the 250 MB limit. Lambda container images support up to 10 GB, allowing inclusion of large dependency sets. Other options are unsupported or do not address the size limit (no snapshots for Lambda, no EBS attachment, architecture change doesn’t reduce package size sufficiently).
Question 4
A company has an ecommerce platform. A developer is designing an Amazon DynamoDB table to store customer order data for the platform. The table uses the order ID as the partition key.
The developer needs to modify the table to get all order IDs that are associated with a given customer email address in a single query. The solution must give the developer the ability to query order IDs by other item attributes in the future.
Which solution will meet these requirements?
A. Configure the partition key to use the customer email address as the sort key.
B. Update the table to use the customer email address as the partition key.
C. Create a local secondary index (LSI) with the customer email address as the sort key.
D. Create a global secondary index (GSI) with the customer email address as the partition key.
Show Answer
Correct Answer: D
Explanation: The base table already uses order ID as the partition key. To support a new access pattern that queries all orders by customer email, a Global Secondary Index is required because it allows a different partition key from the base table. Using customer email as the GSI partition key enables efficient queries for all order IDs associated with an email address. GSIs also support additional future query patterns on other attributes.
Question 5
A developer built an application that uses AWS Lambda functions to process images. The developer wants to improve image processing times throughout the day.
The developer needs to create an Amazon CloudWatch Logs Insights query that shows the average, slowest, and fastest processing time in 1-minute intervals.
Which query will meet these requirements?
A.
B.
C.
D.
Show Answer
Correct Answer: A
Explanation: AWS Lambda writes a REPORT log line for each invocation that includes the execution Duration. A correct CloudWatch Logs Insights query must filter for REPORT entries, then calculate avg(Duration), max(Duration), and min(Duration) grouped into 1-minute bins (bin(1m)). Option A does exactly this, producing average, slowest, and fastest processing times per minute. The other options either filter the wrong log entries or do not aggregate duration correctly.
Question 6
A developer is building an application that stores sensitive user data. The application includes an Amazon CloudFront distribution and multiple AWS Lambda functions that handle user requests.
The user requests contain over 20 data fields. Each application transaction contains sensitive data that must be encrypted. Only specific parts of the application need to have the ability to decrypt the data.
Which solution will meet these requirements?
A. Associate the CloudFront distribution with a Lambda@Edge function. Configure the function to perform field-level asymmetric encryption by using a user-defined RSA public key that is stored in AWS Key Management Service (AWS KMS).
B. Integrate AWS WAF with CloudFront to protect the sensitive data. Use a Lambda function and self-managed keys to perform the encryption and decryption processes.
C. Configure the CloudFront distribution to use WebSockets by forwarding all viewer request headers to the origin. Create an asymmetric AWS KMS key. Configure the CloudFront distribution to use field-level encryption. Use the AWS KMS key.
D. Configure the cache behavior in the CloudFront distribution to require HTTPS for communication between viewers and CloudFront. Configure GoudFront to require users to access the files by using either signed URLs or signed cookies.
Show Answer
Correct Answer: A
Explanation: The requirement is to encrypt only specific fields in user requests so that only designated parts of the application can decrypt them. CloudFront field-level encryption is designed for this use case: it encrypts selected request fields at the edge using an asymmetric public key, and only trusted application components with the private key can decrypt the data. Using Lambda@Edge to apply field-level asymmetric encryption with a user-defined RSA public key satisfies selective encryption and controlled decryption. The other options either do not provide field-level encryption, misuse KMS with CloudFront field-level encryption, or only secure transport rather than encrypting data fields.
Question 7
A developer is designing an event-driven architecture. An AWS Lambda function that processes data needs to push processed data to a subset of four consumer Lambda functions. The data must be routed based on the value of one field in the data.
Which solution will meet these requirements with the LEAST operational overhead?
A. Create an Amazon Simple Queue Service (Amazon SQS) queue and event source mapping for each consumer Lambda function. Add message routing logic to the data-processing Lambda function.
B. Create an Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the four consumer Lambda functions to the topic. Add message filtering logic to each consumer Lambda function. Subscribe the data-processing Lambda function to the SNS topic.
C. Create a separate Amazon Simple Notification Service (Amazon SNS) topic and subscription for each consumer Lambda function. Add message routing logic to the data-processing Lambda function to publish to the appropriate topic.
D. Create a single Amazon Simple Notification Service (Amazon SNS) topic. Subscribe the four consumer Lambda functions to the topic. Add SNS subscription filter policies to each subscription. Configure the data-processing Lambda function to publish to the topic.
Show Answer
Correct Answer: D
Explanation: Using a single SNS topic with subscription filter policies allows the producer Lambda to publish once while SNS handles routing based on message attributes. Each consumer Lambda only receives relevant messages without additional filtering logic or multiple topics/queues. This minimizes coupling, simplifies management, and has the least operational overhead compared to adding routing logic to the producer or consumers.
Question 8
A company has an AWS Step Functions state machine named myStateMachine. The company configured a service role for Step Functions.
The developer must ensure that only the myStateMachine state machine can assume the service role.
Which statement should the developer add to the trust policy to meet this requirement?
A.
B.
C.
D.
Show Answer
Correct Answer: A
Explanation: To ensure that only a single AWS Step Functions state machine can assume the service role, the trust policy must explicitly scope the sts:AssumeRole permission to the exact ARN of myStateMachine using a Condition with aws:SourceArn. Option A does this by matching the specific state machine ARN, preventing any other state machines or principals from assuming the role.
Question 9
A company uses two AWS accounts: production and development. The company stores data in an Amazon S3 bucket that is in the production account. The data is encrypted with an AWS Key Management Service (AWS KMS) customer managed key. The company plans to copy the data to another S3 bucket that is in the development account.
A developer needs to use a KMS key to encrypt the data in the S3 bucket that is in the development account. The KMS key in the development account must be accessible from the production account,
Which solution will meet these requirements?
A. Replicate the customer managed KMS key from the production account to the development account. Specify the production account in the key policy.
B. Create a new customer managed KMS key in the development account. Specify the production account in the key policy.
C. Create a new AWS managed KMS key for Amazon S3 in the development account. Specify the production account in the key policy.
D. Replicate the default AWS managed KMS key for Amazon S3 from the production account to the development account. Specify the production account in the key policy.
Show Answer
Correct Answer: B
Explanation: To encrypt data in the development account while allowing access from the production account, the correct approach is to create a new **customer managed KMS key in the development account** and add the production account to that key’s policy. Customer managed keys allow cross-account access through editable key policies. AWS managed keys (such as aws/s3) cannot be shared or modified to grant cross-account permissions, and KMS keys cannot be replicated across accounts. Therefore, option B is the only solution that satisfies all requirements.
Question 10
A company has an application that runs on Amazon EC2 instances. The application needs to use dynamic feature flags that will be shared with other applications. The application must poll on an interval for new feature flag values. The values must be cached when they are retrieved.
Which solution will meet these requirements in the MOST operationally efficient way?
A. Store the feature flag values in AWS Secrets Manager. Configure an Amazon ElastiCache node to cache the values by using a lazy loading strategy in the application. Update the application to poll for the values on an interval from ElastiCache.
B. Store the feature flag values in an Amazon DynamoDB table. Configure DynamoDB Accelerator (DAX) to cache the values by using a lazy loading strategy in the application. Update the application to poll for the values on an interval from DynamoD
C. Store the feature flag values in AWS AppConfig. Configure AWS AppConfig Agent on the EC2 instances to poll for the values on an interval. Update the application to retrieve the values from the AppConfig Agent localhost endpoint.
D. Store the feature flag values in AWS Systems Manager Parameter Store. Configure the application to poll on an interval. Configure the application to use the AWS SDK to retrieve the values from Parameter Store and to store the values in memory.
Show Answer
Correct Answer: C
Explanation: AWS AppConfig is purpose-built for dynamic configuration and feature flags. Using the AWS AppConfig Agent on EC2 provides local caching and polling via a localhost endpoint, minimizing application changes and operational overhead. It natively supports shared feature flags, controlled deployments, and efficient polling without building custom caching or data access layers, making it the most operationally efficient solution.
$19
Get all 555 questions with detailed answers and explanations
Instant download HTML + PDF delivered the moment payment clears.
Secure Stripe checkout we never see or store your card details.
7-day refund if files are defective see our refund policy.