DVA-C02 practice questions
AWS · DVA-C02 · 300 questions
Original practice questions for the AWS Certified Developer – Associate (DVA-C02) exam, covering development with AWS services, security, deployment, and troubleshooting and optimization.
This course contains the use of artificial intelligence.
About the DVA-C02 exam
- Exam fee
- $150 USD
- Time allowed
- 2 hours 10 minutes
- Questions
- 65
- Passing score
- 720 (scale 100-1000)
- Format
- Multiple choice or multiple response
Exam details published by the vendor, checked 28 August 2026. Vendors change fees and formats without notice — confirm on the vendor's own page before you book.
Practice Quizzes
Test your knowledge with standard 20-question practice sets.
Quiz 1
Quiz 2
Quiz 3
Quiz 4
Quiz 5
Quiz 6
Quiz 7
Quiz 8
Quiz 9
Quiz 10
Quiz 11
Quiz 12
Quiz 13
Quiz 14
Quiz 15
Browse by Domain
Study specific topics at your own pace.
Development with AWS Services · 96 questions
- A city permitting portal must wake the intake service only when a payment clears, without a nightly batch job polling a database. Which application pattern should the developers implement?
- A county clerk wants building permits, fees, and inspections as separately deployable services, each with its own data store, so one team's release does not freeze the others. Which pattern matches that goal?
- A small township library app is one deployable unit sharing one schema, maintained by three staff. Leadership asks whether splitting into ten services is mandatory on AWS. Which statement is accurate?
- After a citizen submits a parks reservation, payment, calendar, and email services each listen for the same domain events and act without a central conductor. Which pattern is this?
- A business-license renewal must run identity check, fee calculation, payment, then license PDF generation in a fixed order, and the help desk needs a visible workflow state to inspect. Which pattern fits best?
- When a snow-emergency flag flips, the same alert must reach SMS subscribers, a dashboard queue, and a logging archive without the weather service calling each consumer itself. Which pattern should developers use?
- A recreation registration API keeps shopping-cart selections only in server memory on one instance; scaling out drops carts mid-checkout. What change best aligns with a stateless compute pattern?
- A municipal Lambda behind API Gateway must remain safe to scale to zero and multiply under load. Developers debate storing citizen wizard progress inside the function container. What should they do?
- The tax portal's invoice service hard-codes direct HTTPS calls and shared database tables into the payment service, so either team's change breaks the other at deploy time. What problem is this, and what direction improves it?
- A 311 photo-upload API currently waits for virus scan and thumbnail generation before returning HTTP 200, causing citizen timeouts on large images. What should developers change?
- A Python permit service calling a third-party address validator fails the whole submit when the vendor blips for two seconds. Which resilience approach should developers apply in application code?
- API Gateway fronts a grant-application API. Invalid ZIP codes and missing required fields currently reach Lambda and clutter logs. Where should developers enforce request validation first?
- A legacy inspection API returns HTTP 200 with an error string in the body. Mobile clients need proper 4xx/5xx status codes and a cleaned JSON shape without rewriting every backend method yet. What should developers use?
- A parks Lambda team wants fast unit tests on laptops before any cloud deploy, mocking AWS calls rather than hitting real DynamoDB. Which practice matches that goal?
- A code-enforcement app must enqueue failed door-hanger print jobs for later retry without blocking the inspector's UI thread. Which approach should the application code take?
- Transit dispatch needs many independent listeners when a bus route detour is published, without the publisher knowing each listener. Which messaging approach should application code use?
- A TypeScript citizen-portal backend must list objects in a departmental S3 bucket using credentials from the runtime role—not hard-coded keys in source. How should it call AWS?
- Before committing, a developer verifies a new DynamoDB table name and an IAM permission boundary using CLI calls from CloudShell against the shared sandbox account. What does this illustrate?
- Water-meter gateways emit continuous reading events that a billing enrichment job must process as a stream, not as overnight CSV drops only. Which AWS approach fits application-level streaming ingest?
- A junior city developer asks Amazon Q Developer to draft a Lambda handler skeleton that reads an SQS event and writes to DynamoDB, then reviews the suggestion for secrets and correctness. Which statement is accurate?
- When an S3 object lands in the permits/incoming/ prefix, a rule should start a validation workflow without polling the bucket. Which service pattern should developers implement?
- Multiple municipal apps publish inspection.completed events; a single analytics consumer should not be wired into each publisher's code. Which EventBridge approach keeps publishers decoupled?
- A courts calendar sync calls a vendor API that returns intermittent HTTP 503s. Naive immediate retries stampede the vendor. What retry strategy should application code implement?
- If the external GIS geocoder is down, the address-lookup feature should fail fast after repeated errors and serve a degraded enter-manually path instead of hanging every request. Which pattern is this?
- A Step Functions-style intake flow needs distinct handling for poison messages versus retryable timeouts when calling a payment gateway. What should developers do?
- A city's vital-records print shop falls behind when peak online orders hit printers synchronously from the web tier. Which change best loosens coupling and absorbs the spike?
- A single case-closed event must feed both a searchable archive queue and a metrics queue, and each consumer must fail and scale on its own. Which pattern should the developer implement?
- A multi-step business-grant approval needs wait states for human review, parallel document checks, and clear success and fail paths. Which AWS service should orchestrate that workflow?
- A mobile field-inspection app needs flexible, client-defined field selection over a graph of related assets instead of a fixed REST resource for every screen. Which API approach fits best?
- A public open-data JSON API needs API keys, throttling, and stage-based deploys in front of a simple CRUD Lambda backend. Which service should front the API?
- A cashier kiosk must show the tax-due balance before printing a receipt; waiting a minute for eventual consistency is unacceptable for that click. Which interaction style should the balance lookup use?
- Council wants the citizen auth gateway to scale horizontally without sticky sessions pinned to a particular EC2 host. Which session approach supports that goal?
- When a hydrant is flagged, three systems should each react on their own with no central state machine and no ordered multi-step waits. Which coordination style fits?
- A records-purge job lists thousands of S3 inventory objects but stops halfway because the code ignores continuation tokens. What should the developer fix?
- Amazon SQS can deliver a meter-reading message more than once, and blindly inserting each delivery would double-bill residents. How should the consumer be designed?
- After maximum receives, unprocessable code-violation payloads must not block the main SQS backlog forever. What should the team configure?
- A developer's unit-test suite creates real SNS topics in the production account during CI because mocks were skipped. What is the correct testing practice?
- A script every five minutes scans a DynamoDB table for unpaid invoices to email reminders, burning read capacity mostly on no-op scans. Which approach better fits an event-driven design?
- A dashboard aggregates three municipal APIs, and one slow dependency should not blank the entire page. Which resilience approach should the developer apply?
- Inspection status updates for one parcel must process in order, but citywide throughput still matters. Which messaging choice best matches that tradeoff?
- A Lambda function must read an Aurora database that is reachable only on private subnets inside the city's VPC. What must the developer configure?
- Feature flags and non-secret DynamoDB table names for a grants Lambda should change per stage without rebuilding the deployment package each time. Where should that configuration live?
- A PDF-merge Lambda for council packets is CPU-bound and slow at 128 MB. What should the developer remember when tuning memory?
- A sudden open-enrollment spike exhausts account concurrency and starves an unrelated payroll Lambda in the same account. How should critical capacity be protected?
- A Lambda that calls a slow legacy mainframe still uses the default 3-second timeout and fails mid-transaction even though the business allows 45 seconds. What should the developer do?
- A team migrates a Node.js handler to Python but leaves the handler string pointing at the old export name, causing runtime import errors. What must be aligned?
- Three municipal Lambdas share the same GIS SDK and logging library, and copying those zip dependencies into every function bloats packages. What should the team use?
- Ops wants a lightweight sidecar-style agent to ship enhanced telemetry from many Lambdas without rewriting business handlers each time. Which Lambda feature fits?
- New objects in an S3 evidence bucket should invoke a redaction function automatically. How should that integration be configured?
- On success, a license-PDF Lambda should hand a summary payload to EventBridge; on failure after retries, it should notify an ops SQS queue. Which feature routes those outcomes?
- A city newsletter Lambda is invoked asynchronously to send bulk alerts. After Lambda exhausts its async retries, failed deliveries must land somewhere the ops team can inspect and replay later. What should the developer configure?
- Before promoting a citizen-portal Lambda to the shared test stage, developers must invoke it locally with a realistic API Gateway proxy event. Which approach best meets that need?
- A voter-registration Lambda must PutItem new registrations and Query by voter ID in DynamoDB while running under the function's execution role. How should the developer implement this?
- Batch meter-reading events arrive on Amazon SQS. A Lambda function should process messages in batches and report which messages failed so successful ones are not reprocessed. What should the developer enable?
- A parks department needs a public HTTPS endpoint that maps HTTP routes to Lambda handlers and can add JWT authorizers later. Which integration should the developer choose?
- A Java Lambda that generates rare monthly utility reports shows multi-second cold starts when the first citizen clicks after long idle periods. Idle cost is a concern for infrequent use. What is the most appropriate performance approach?
- A simple JSON-transform Lambda ships a 250 MB deployment package, slowing updates and cold starts. What should the developer do?
- Parking-sensor heartbeats arrive on Amazon Kinesis. Within seconds of arrival, records must be enriched and written to DynamoDB. Which pattern should the developer use?
- A multi-step FOIA redaction workflow must run separate Lambda tasks with retries per state rather than one mega-function. What should the developer use?
- Product wants richer success payloads routed to a downstream event bus when a Lambda finishes, not only failure capture after async retries. Which capability should the developer prefer?
- A media-processing Lambda must unpack a ZIP of permit drawings into a few hundred MB of scratch space before uploading results to S3. Where should that ephemeral workspace live?
- An SQS-triggered fee-posting Lambda can be invoked more than once for the same message because of at-least-once delivery. Double posts would corrupt municipal ledgers. What must the handler do?
- An S3 bucket event cannot invoke a redaction Lambda because the function's resource-based policy does not allow the bucket's principal. What should the developer fix?
- During open enrollment, API clients receive HTTP 429 responses while a Lambda function’s reserved concurrency is set far below actual demand. Code errors are not appearing in logs. What is the likely diagnosis and fix direction?
- Weather alerts published to Amazon SNS must fan into a Lambda that opens incident tickets. How should the developer connect them?
- The same grant-scoring Lambda code needs higher memory and longer timeout in load-test than in production. How should configuration differ across environments?
- Business rules for grant scoring are tangled with AWS SDK calls inside one Lambda handler, making unit tests slow and brittle. What structural change helps?
- A poison record in a Kinesis batch causes the water-quality Lambda to fail the entire batch and stall shard iterator progress. What should the developer apply?
- Several municipal Lambdas need shared read access to a large GIS tile cache with POSIX file semantics that exceed practical /tmp size. What should they mount?
- Encoding 45-minute city council session videos exceeds practical Lambda maximum duration, yet ops only keeps raising the function timeout. What should the team do instead?
- A 911-adjacent callback API on Lambda must keep consistently low latency; the agency accepts paying for idle warm capacity. Which setting addresses cold starts?
- A Lambda that only writes to one DynamoDB table was given AdministratorAccess to unblock a sprint. What should replace that policy?
- A city stores every parking ticket under the DynamoDB partition key CITY#ALL, causing a hot partition during ticket season. How should the key design change?
- After a cashier posts a fee, the next read of the resident balance on another path sometimes shows the old amount when using eventually consistent reads. Staff need the latest balance immediately. What should the developer select?
- A dashboard refreshes all open cases citywide by running a full DynamoDB table Scan every minute, consuming excess capacity. What should the developer prefer?
- A city case-management app must fetch a case by caseId and also list a citizen’s cases by citizenId plus filing date. Why is a single partition key alone a poor fit?
- County inspectors must filter field jobs by status and district without table scans. Status alone has only a few values. Which DynamoDB design best supports that query?
- Within one municipal permit partition key, clerks need items sorted either by create-date or by fee-amount without copying the table. Which DynamoDB feature fits?
- A Node.js inspection service must persist a nested checklist object to DynamoDB without turning numbers into unexpected strings or dropping nested maps. What should the team use?
- A seasonal city tax portal sees quiet winters and sharp April filing spikes. Which DynamoDB capacity approach best matches that traffic shape?
- Finance must move funds across multiple appropriation accounts in one ACID transaction with multi-row SQL updates. Which data store choice fits best for the application?
- Public-works as-built PDF plan sets are large. How should a developer persist them alongside DynamoDB case metadata?
- Permit drawings older than seven years must move to cheaper storage automatically yet remain restorable for audits. What should the developer configure?
- Transient email-verification codes for citizen accounts should expire automatically without a nightly sweeper job. Which DynamoDB feature should the app use?
- A read-heavy open-data catalog hammers Aurora with identical queries for popular datasets. What application-level change reduces database load?
- After publishing a corrected fee schedule, citizens still see old prices for minutes because the app caches by TTL only. What should developers do?
- Staff need typo-tolerant full-text search across free-text complaint narratives, not just exact DynamoDB key lookups. Which service fits that access pattern?
- Analysts need ad-hoc SQL over years of CloudTrail and app logs landed as Parquet on S3 without standing up a permanent warehouse cluster. Which approach fits?
- A single EC2 report worker needs local scratch disk; a fleet of workers needs a shared POSIX tree; durable citizen blobs need object storage. Which pairing is correct?
- Two clerks may update the same case-notes item concurrently. How should the app prevent silent overwrites in DynamoDB?
- A globally replicated municipal settings table holds feature flags for kiosk apps that can tolerate brief staleness. Which DynamoDB read consistency choice is appropriate by default?
- Embedding base64 building photos in DynamoDB items approaches size limits and slows reads. What should developers do?
- When a parcel record changes in DynamoDB, a search index and an audit log must update. Which integration pattern should the developer use?
- Hundreds of concurrent Lambdas each open a new RDS connection per invoke and exhaust maxconnections. What should the team implement?
- A team debates one DynamoDB table with careful keys versus many tables that mirror a relational permits schema. What modeling guidance should developers follow?
- Citizens see intermittent ProvisionedThroughputExceeded during enrollment peaks. Besides blind retries, what should developers address?
Security · 78 questions
- Residents should sign into the parks mobile app with the city’s existing social/OIDC identity provider without the app storing passwords. Which approach fits?
- After Cognito login, the parks mobile app must upload photos to each citizen’s own S3 prefix using temporary AWS credentials. Which Cognito capability vends those credentials?
- API Gateway protects municipal APIs with JWTs issued after Cognito login. What must backends do on each call?
- A CI build role must push an image to Amazon ECR without access keys in the Jenkinsfile. How should programmatic access be configured?
- A city permitting portal runs on Elastic Beanstalk and must call DynamoDB from the app without hard-coding AWS keys. How should the SDK authenticate?
- A county payments Lambda in Account A must write audit objects into a logs bucket owned by Account B. Which approach correctly grants temporary, scoped access?
- An inspection-api ECS task role must read case rows from one DynamoDB table. Which permissions statement best matches least privilege?
- Two municipal clerks share the same Cognito group for the permit desk but must edit permits only for their own district. What should the application enforce beyond the shared group?
- A city’s fees microservice must call the ledger microservice with authenticated identity and must not share end-user passwords between services. Which pattern fits?
- Uploads to a municipal evidence bucket should succeed only when the object key prefix matches the caller’s department tag. Which IAM technique enforces that attribute-based rule?
- A partner county role in another AWS account must read objects under a shared GIS export prefix in the city’s S3 bucket. Which policy placement is the clean cross-account pattern?
- A contractor committed long-term AWS access keys for a city recreation app into a public Git repository. What should the team do first for application access going forward?
- A public single-page app for resident park reservations uses Amazon Cognito. How should the Cognito app client be configured for that SPA?
- Unauthorized callers should be rejected before a city grants Lambda runs for a protected API. Where should JWT validation happen?
- A break-glass admin CLI session for a municipal tax tool should avoid permanent access keys on a laptop. What is the preferred credential pattern?
- A developer for a county tax service chains three AssumeRole hops because a blog sample did, which complicates audits. What should the team prefer?
- A new Lambda for building-permit webhooks fails because it cannot assume its execution role. The role’s trust policy does not allow the Lambda service. What should be fixed?
- A read-only open-data client token must not be able to call write endpoints on the same municipal API. How should access be enforced?
- An AWS Organizations SCP blocks s3:DeleteObject citywide. A purge job’s application role policy allows s3:DeleteObject on a staging bucket. What happens?
- City employees authenticate through a workforce identity provider, while residents use Amazon Cognito user pools for citizen apps. What identity approach should the team keep?
- A custom HTTP client on a lobby kiosk signing AWS API requests fails with SignatureDoesNotMatch after the kiosk clock drifts. What SigV4 requirement is most likely involved?
- A CI pipeline role may deploy one SAM stack in the city’s test account but must not create IAM users. How should that deploy principal be scoped?
- Mobile inspectors remain in the field for hours; access tokens expire and uploads begin failing silently. What should the client implement?
- Before shipping, a developer checks whether an IAM policy that allows dynamodb:Query only on a table ARN also covers Query calls that target a global secondary index. What should they understand?
- Account A must put events onto an EventBridge event bus in Account B for a multi-account city services mesh. What must be true?
- A burst of credential-stuffing attempts hits the citizen login API in front of API Gateway/CloudFront. Which edge control is commonly proposed?
- A ticket asks an application developer to create twenty IAM users with passwords for external contractors on a city project. Relative to the DVA-C02 target role, what is the better framing?
- A case-management app grants access when the caller’s PrincipalTag Department equals department tags on case-folder resources. Which authorization model is this?
- A small town wants a quick compliant hosted login page for a citizen portal, while a larger city needs fully branded screens that call Cognito APIs directly. How should each choose?
- A city permitting API returns bearer tokens to mobile clients. A developer proposes logging every Authorization header to CloudWatch Logs for easier debugging. What should the team do?
- A county runs a public citizen API and a payroll microservice as separate ECS services. Security wants a breach of the public API task unable to write to payroll DynamoDB tables. How should task IAM be designed?
- A city open-data team needs a partner system to pull a bulk GIS feed with rate limits, while citizens still sign in to a separate account portal. Which auth approach fits each audience?
- A municipal Lambda role is allowed kms:Decrypt by its identity policy, but sealed case PDFs still fail to open. An SCP on the account includes an explicit Deny for kms:Decrypt. What explains the failure?
- During an incident, a county break-glass role can be assumed with broad S3 read. Responders must further limit temporary credentials so s3:GetObject works only under the evidence/incident-42/ prefix. What should they pass when assuming the role?
- A parks department app lets guests browse public park maps without signing in, but write APIs for reservation changes must require authenticated users. How should Cognito identity pools be used?
- A nightly batch reconciler with no human operator must call an internal municipal fees API that expects OAuth tokens. Which approach is appropriate?
- A city council member asks whether requiring HTTPS to DynamoDB means citizen records are encrypted on disk inside AWS. What should the developer explain?
- Internal microservices for a city’s tax stack must authenticate to each other with TLS certificates that are not public website certs. Which approach fits?
- Highly sensitive case files must be encrypted in the application before PutObject so AWS never sees plaintext, while ordinary park-photo buckets can use SSE-S3 or SSE-KMS. What contrast should developers apply?
- A Lambda that connects to a legacy host must decrypt a sealed configuration blob using a customer managed KMS key before startup. What must the function do?
- Developers need SSH key pairs for a bastion jump box used only in the city’s sandbox account during feature work. What is the sound practice?
- Account A owns a KMS CMK that encrypts objects in a shared evidence bucket. Account B’s application role must decrypt those objects. What must be configured?
- Security policy requires annual automatic rotation for customer managed KMS keys that protect citizen PII DynamoDB tables. What should the developer enable?
- Open-data park assets need simple server-side encryption, while regulated PHI attachments need customer managed keys with CloudTrail-visible key use. How should developers choose?
- A municipal batch job encrypts multi-gigabyte evidence files with KMS. Why should it use data keys (envelope encryption) instead of sending entire payloads to the KMS Encrypt API?
- Citizen browsers must reach the city services portal only over HTTPS with a valid certificate on the custom domain. What should the team configure?
- A new Aurora cluster will store municipal health records. Security requires encryption at rest from day one. What should the team do when provisioning?
- The city requires customer-controlled keys and audit of key use for a DynamoDB table of sealed case indexes. Do AWS owned keys meet that bar?
- Two microservices exchange sensitive permit payloads inside the city’s VPC. A developer claims private subnets make TLS unnecessary. What is the better guidance?
- Municipal app config currently hard-codes raw KMS key IDs. Operators want rotations and re-pointing without hunting every service for ARNs. What practice helps?
- During an incident drill, an operator disables a CMK that still encrypts historical archive objects an archives Lambda must decrypt. What operational impact should the team expect?
- All new objects in the city’s evidence bucket must be stored with SSE-KMS even when an SDK PutObject omits encryption headers. What should administrators set?
- A lab misconfiguration pointed the AWS SDK at a custom DynamoDB endpoint over HTTP, creating a risk of credential and data exposure. What must production clients use?
- A project manager says signing the Lambda deployment package with code signing means citizen SSN fields are encrypted at rest in DynamoDB. What distinction should the developer draw?
- A county grants portal shares a KMS customer managed key with a partner AWS account so the partner can decrypt grant packages in S3. The partner must not administer the key, create grants for others, or change the key policy. What should the city grant?
- The city wants api.city.gov as a custom domain on API Gateway and needs a publicly trusted TLS certificate that ACM can manage where regional API Gateway custom domains are supported. Which approach fits?
- Citizen profiles in DynamoDB are ordinary JSON documents, but Social Security numbers must remain unreadable even to operators who can read the table in the console. Only those SSN fields should be protected this way. What should the application do?
- A legacy report engine on EC2 writes citizen extracts to an attached data volume. Security requires that volume's data be encrypted at rest. What should the developers ensure?
- An AMI for the parks payment listener was baked with TLS private keys in the image for "convenience." Every new instance clone now carries those keys. What is the secure fix?
- After a contractor is offboarded, the city must re-encrypt a subset of grant files under a new data-key hierarchy so the contractor's former access path cannot decrypt them. What should the application team plan?
- A parks dataset mixes public park hours with resident home addresses and phone numbers. Logging currently writes both kinds of fields the same way to CloudWatch. What should developers do first?
- A municipal health clinic app stores appointment notes that qualify as PHI. Ordinary public-works service tickets in another module do not. What should the team recognize when securing the clinic notes?
- Database passwords for the permits API were pasted into plaintext Lambda environment variables that broad IAM roles can read in the console. What is the preferred remediation?
- The business-license renewal Lambda must obtain RDS credentials at runtime with managed rotation, not from a checked-in .env file in the repository. Which approach meets that requirement?
- Exception handlers in the payments API dump full HTTP bodies into CloudWatch Logs, and some bodies contain cardholder data fragments. What should developers change?
- Help-desk staff verifying a resident on the city portal should see only the last four digits of the SSN on identity screens, not the full number. Where should that control be enforced for the UI?
- Two school districts share one SaaS-style deployment of a student services app. Queries must never return another tenant's student rows even if object IDs are similar. What multi-tenant data pattern should the code enforce?
- RDS credentials in Secrets Manager rotate every 30 days. The grants API caches the secret in memory and must keep serving traffic when rotation occurs. What should the application implement?
- A React single-page app for recreation registration embeds a privileged Cognito app client secret and a long-lived AWS access key in the browser bundle. What should the team do?
- The city payment form already receives a processor token after card settlement, but the app still stores full card PANs in DynamoDB "for convenience." What is the correct data-minimization action?
- Feature flags for the portal can be ordinary configuration, but third-party API tokens must not sit in plaintext parameters. How should Parameter Store / Secrets Manager usage be matched to sensitivity?
- Tenant A's JWT must not authorize Tenant B's API paths even when object IDs are guessable. Beyond verifying the JWT signature, what must the API enforce?
- A debug export tool used by support engineers dumps full date-of-birth values and medical notes from tickets by default. What should be built into that operational tooling?
- Auditors ask the grants team to confirm that the production Secrets Manager secret store protecting database credentials uses encryption at rest with an appropriate customer managed key policy. What should they verify?
- A CloudFormation template parameter Default embeds the production webhook signing secret in version control. How should the team supply that secret instead?
- Clickstream analytics for the city portal accidentally forwards raw resident email addresses into a less-controlled OpenSearch index used by interns. What should the pipeline do?
- District file uploads land under s3://bucket/{tenantId}/... and IAM policies must ensure a principal can only access its own tenant prefix. Which pattern supports enforceable isolation?
- API 500 responses currently return SQL text and row images of citizen records to make debugging easier for mobile clients. What should the API return instead?
Deployment · 72 questions
- A municipal Lambda deployment package omits a native library that exists on a developer's laptop, so production invocations crash on import even though local tests pass. What should the team ensure when preparing the artifact?
- A city permitting portal bakes stage-specific API base URLs into the built Lambda zip, so every environment change forces a full rebuild. What should the developers do?
- An ECS service that OCRs scanned municipal deeds should always run a known image from Amazon ECR in production. Which practice best meets that requirement?
- A SAM project for a county records API packs unit tests, Markdown docs, and multi-gigabyte sample media into the same directory that becomes the deployment bundle. What should the team change?
- A municipal DevOps policy says the test environment deploys from the develop branch while production deploys only from tagged releases on main. How should the team wire deployments?
- During council week, a PDF generation service on Elastic Beanstalk or ECS falls behind because tasks were sized with too little CPU. What should developers declare for the artifact?
- The city fees UI needs feature toggles that can roll out or roll back instantly without redeploying Lambda code. Which AWS capability best fits?
- Developers commit compiled nodemodules into Git so municipal deploys feel reproducible, but diffs are noisy and CI still sees platform skew. What is the better approach?
- For a grants intake stack, the team wants the Lambda function, API Gateway, and DynamoDB table versioned together. What should live in the application repository?
- Verbose debug logging is enabled in a shared config that currently ships in every package, including production. What should the team do for environment-specific configuration?
- A Lambda that preprocesses large GIS libraries for a parks department exceeds practical zip size and dependency constraints. Which packaging guidance should the team apply?
- CI installs different transitive dependency versions than developers' laptops, and Elastic Beanstalk deploys then fail. What practice prevents that drift?
- A .env.production file containing live database credentials was zipped into a CodeDeploy bundle for a civic payments API. What should packaging enforce?
- CloudFront caches a citizen portal's JavaScript aggressively, so releases sometimes leave browsers on stale bundles. How should the build artifact address this?
- A static park-map front end should give stakeholders a preview URL per Git branch. Which Amplify-oriented artifact approach fits?
- After deploying a permit API to the shared sandbox, engineers need confidence before asking QA for sign-off. What should they do next?
- CI tests for a municipal permit service call a third-party payment gateway and sometimes charge cards or fail when the vendor is down. How should integration tests be written?
- Developers need unfinished API routes isolated from citizens while QA still exercises a stable candidate. How should API Gateway stages be used?
- A stack update for the grants API must refresh staging without changing production parameters. What is the correct targeting approach?
- An EventBridge → Lambda → DynamoDB flow for license renewals needs confidence beyond unit-mocked handlers. What testing approach fits the deployed path?
- Mobile and backend teams agree on an OpenAPI contract for a city services app, and CI must fail if staging drifts. What should they automate?
- After each staging deploy of a citizen records API, the team wants a fast signal that the environment is basically healthy. What should they automate?
- Before pushing a grants Lambda that occupies the shared sandbox, a developer wants a quick local check with a fixture event. Which tool fits?
- A new ECS task definition revision for a document OCR service is ready. Where should it be verified before production?
- Staging tests for a licensing API currently cover only successful authenticated requests. What else must they include?
- QA accidentally pointed integration tests at the production DynamoDB table name through a wrong parameter. What must test environments ensure?
- A city transit telemetry team is writing unit-style consumer tests for a Kinesis Data Streams processor. Developers need repeatable, crafted records without waiting for live buses. What approach fits Domain 3 testing for streaming consumers?
- A county permitting app on Elastic Beanstalk ships a new version to staging. Health checks fail before anyone discusses a DNS cutover. What should the team do first?
- Two municipal developers work on separate feature branches for a parks reservation API. Both need to exercise SAM resources without overwriting the shared team development stack. What pattern should they use?
- A staging CloudFormation deploy for a clerk fee API reports CREATECOMPLETE, but the first runtime GetItem against DynamoDB fails with AccessDenied. Integration tests catch it before promotion. What does this validate about environment testing?
- A city inspection Lambda is invoked by API Gateway proxy events and by SQS. The team wants CI to invoke the function the same way every build. Where should the JSON test event payloads live?
- A township uses one OpenAPI definition for its business-license API across environments, but each stage must call a different backend. How should that be deployed?
- County integration tests must stay on an approved Lambda build while developers keep iterating on unpublished code. How should aliases be used?
- QA for a municipal containerized fee service must pull only images that passed vulnerability scans. Which tagging practice supports that gate?
- Product owners need to click through a new citizen self-service UI before merge. The front end is an Amplify app on a feature branch. What should they use?
- A multi-service recreation registration stack managed with AWS Copilot needs a place for QA sign-off on the approved build. What should host that candidate?
- Engineers add a new SQS queue and Lambda function for court-notice delivery to an existing SAM template. How should the change reach staging?
- Ops wants a CloudWatch alarm added to a nested application stack used by the city utilities portal in test—without manual console clicking. What is the preferred approach?
- A municipal API Gateway API has distinct stages for development, test, and production. Each stage must invoke a different Lambda alias. How should that wiring be managed?
- A developer uses Amazon Q Developer to draft unit tests for a pure municipal fee-calculation module, then plans the next step. What is the correct expectation?
- Every deploy to the city’s staging environment must prove the candidate build has not broken prior behavior before promotion. What pipeline gate fits?
- Before applying infrastructure changes for a library catalog service to the test account, CI should show what will change. Which CDK practice supports that review?
- After a test-environment deploy of a permit-write API, the pipeline should prove one critical path still works without leaving junk data. What should run next?
- API tests for a building-permit service need known rows in the test DynamoDB table before each run. How should that data be prepared?
- A developer removes a required JSON field from a city licensing API response. What should happen in the test stage before production?
- Only builds that passed the municipal test environment’s automated suite should be eligible for later promotion. How is that eligibility usually expressed?
- CI evaluates a SAM template for a utilities admin API and finds a security group that opens an admin port to 0.0.0.0/0. What should the pipeline do?
- Before open enrollment, a school-district registration API candidate must prove it can handle a surge in a pre-production environment. What test belongs there?
- Ops asks whether a new court-document Lambda for this release train should ship as a zip artifact from S3 or as a container image from Amazon ECR. What distinction should guide the choice?
- Citizens should reach the production licensing API at api.city.gov rather than the default execute-api URL, and that hostname must map to the prod stage. What configuration achieves that?
- A parameter increase for Lambda memory is required on an existing municipal SAM application. How should that change be released to the managed environment?
- A municipal permits team keeps development, test, and production CloudFormation stacks in separate AWS accounts with distinct parameter sets. What environment-management practice should they follow when promoting a release?
- A citizen-facing fee API must cut over with minimal downtime and a quick path back if errors spike. The team is choosing among blue/green, canary, and rolling for the next release. Which selection best matches a risk profile that needs an instant cutover with an idle prior environment ready?
- A county GIS portal team wants merges to main to start automated tests, deploy to an Elastic Beanstalk test environment, then wait for a human gate before production. Which approach implements that commit-triggered path?
- A city transit API pipeline must promote one build through test, staging, and production with approvals between stages. What CodePipeline practice ensures the same artifact moves across those environments?
- After a bad Lambda alias traffic shift for a municipal payments function, CloudWatch shows error spikes. How should operations roll back quickly using existing versioning?
- Release v2026.08.19 for a library catalog API must be auditable across Git and the deployment pipeline. Which release-management practice meets that need?
- A parks department API Gateway has stages for test and prod. Developers want each stage to invoke a different Lambda alias without cloning the entire API definition. Which feature provides that dynamic stage-to-backend binding?
- A containerized 311 intake service on ECS must cut over safely and keep the prior task set for a fast revert. Which blue/green approach fits?
- For a high-risk utility billing Lambda, the team wants only ten percent of API traffic on the new version for fifteen minutes before a full shift. Which deployment strategy should they configure?
- A weekday release for a multi-instance Elastic Beanstalk permitting site must replace instances gradually while keeping enough capacity online. Which strategy fits that platform constraint?
- Before any deploy stage for a municipal records API, unit tests and lint must run with cached dependencies. Which service should provide that CI build/test compute in the pipeline?
- Operations must push a revision to EC2, Elastic Beanstalk, ECS, or Lambda using a configured deployment strategy. Which AWS service is purpose-built to deliver that revision to those compute targets?
- A planning-department team already has Source, Build, and Deploy actions defined and needs them wired with a manual approval before production. Which service should orchestrate those existing CI/CD stages?
- Internal Python wheels for municipal GIS helpers must be installed during CodeBuild without relying only on the public internet. Which service should act as the private package repository?
- A classic multi-instance web app that issues building permits should run on a PaaS path with environment-level rolling updates. Which AWS deployment option best matches that application shape?
- Containerized citizen-notification workers must roll out by registering a new task definition on Amazon ECS. Which deployment action aligns with that platform?
- A city open-data front end uses Amplify. Production should publish from the main branch only after QA validates a preview branch. Which Amplify practice supports that?
- Infrastructure for a test-account permitting stack is defined in TypeScript with the AWS CDK. Which action applies that definition to the test environment?
- After staging metrics for a court-records API look healthy, production still needs a change-advisory human gate in the pipeline. What should the team configure?
- Production for a tax-portal release must deploy the exact build artifact that passed staging. Which practice preserves that guarantee?
- A stem asks the developer to invent an organization-wide multi-account DevOps platform topology before shipping a small civic API change. How should a DVA-C02 candidate interpret that task?
Troubleshooting and Optimization · 54 questions
- Citizens report double charges on a fee API. Logs show the payment handler processing the same retried request twice without an idempotency check. What is the most likely code-level root cause to fix?
- Error rate for a city payments Lambda is flat, but p99 latency spiked. X-Ray shows a slow downstream payment provider call rather than elevated Lambda CPU. Where should the team focus first?
- After a citizen complaint, engineers must find all log events that mention a specific permitId across thousands of lines. Which approach extracts those events quickly?
- Business stakeholders want a CloudWatch metric for permits submitted, emitted from the application's structured logs, without flooding the API with separate PutMetricData calls. Which approach should developers implement?
- During a weather-emergency surge, a municipal ops desk opens one view that shows API Gateway 5xx rates, Lambda duration, and DynamoDB throttle counts together. What should they use to review that application health in one place?
- A city Elastic Beanstalk release through CodeDeploy fails. Service output logs show a failed health-check hook, not a compile error. What should the team conclude first?
- A municipal permit queue grows because an SQS-triggered Lambda’s batch size and visibility timeout do not match how long each batch takes to process. What is the most likely integration problem?
- Citizen profile PutItem calls fail while CloudWatch shows ProvisionedThroughputExceeded on the table. Developers suspected a null-pointer in app code. What does the evidence indicate?
- One citizen checkout spans API Gateway, Lambda, Step Functions, and DynamoDB, and support needs to see which hop failed. Which approach best finds the failing step?
- A library catalog Lambda is slow only on the first request after idle; later calls are fine. What latency pattern does that most strongly suggest?
- After an IAM role policy change, municipal Lambda logs show AccessDenied on s3:GetObject for a known object key. What is the most likely root cause?
- After a canary deployment, error budgets burn and logs/metrics implicate the new Lambda version. What observability-backed action should the team take?
- SigV4 signature failures cluster on one park-kiosk image whose clock is wrong via NTP, while other kiosks succeed. What environmental cause should developers check?
- Inspection events land in an SQS dead-letter queue. Opening the poison messages shows a newer JSON schema the consumer does not understand yet. What should analysis conclude?
- Right after a release, DynamoDB consumed write capacity roughly doubles at the same citizen traffic level. What should the team do with metrics?
- Support cannot stitch API Gateway access logs to Lambda log lines for one citizen complaint because nothing ties the records together. What should the app include?
- X-Ray traces mark some downstream calls as errors (client 4xx) and others as faults (5xx). Why does that classification matter for a municipal incident?
- A grants Lambda extracts ZIPs into /tmp; later invokes on the same warm environment fail in odd ways. What resource problem fits?
- Production suddenly looks empty: reads miss citizen rows that still exist. A pipeline parameter typo pointed the app at the test table name. What should troubleshooting check first?
- A partial outage plus aggressive client retries turns into DynamoDB throttling across the fleet. What contributing cause should developers address?
- A program manager says the permit platform already has logs, so it has full observability. How should engineers clarify the gap?
- For a building-permit workflow, which logging strategy best records behavior without drowning operators in noise?
- Default AWS metrics do not show how many permit jobs a worker cleared from a custom backlog. What should the code emit?
- During incidents, engineers need to filter traces by districtId and permitType. What should they add in the application?
- Ops wants SNS notices when account-level Lambda concurrency nears quota and when a production deploy finishes. What should they implement?
- A citizen request crosses API Gateway into Lambda, and the team wants a service map of that path. What should they enable?
- Operators struggle to query free-text Lambda logs for citizenId, action, and latencyMs. What logging change helps CloudWatch Logs Insights?
- An ALB target group for an ECS civic app should not receive traffic until DB connections are warmed and feature flags are loaded. What should they configure?
- Structured logs for a benefits app accidentally include Authorization headers and raw SSNs. What instrumentation rule was broken?
- A municipal payment portal must page on-call staff when HTTP 5xx rises and also when successful payment count stays at zero for fifteen minutes during office hours. How should the city developer design CloudWatch alerting?
- A high-volume city telemetry API cannot afford to record an X-Ray trace for every request without exploding cost. What sampling approach should the developer apply?
- A county Lambda in production writes DEBUG logs with infinite CloudWatch Logs retention, driving cost and widening exposure of sensitive permit fields. What should the developer change?
- Critical CloudWatch alarms for a city permitting API must reach the on-call municipal engineer quickly. Which wiring best matches how operators actually get paged?
- A citizen GIS lookup API is slow, but overall API duration mixes city code with a third-party GIS vendor. How should the developer instrument latency for clearer ownership?
- X-Ray service maps for a parks permit Lambda blur DynamoDB and outbound HTTP into the parent segment. What should the developer add for clearer remote call visibility?
- A municipal cache-warming process can keep a container process alive while it is still not ready to serve citizen traffic. How should health probes be designed?
- Operators need the same request identifier in API Gateway access logs, Lambda logs, and X-Ray traces for a single citizen complaint. What practice enables that correlation?
- CloudWatch custom metrics for a permitting API need actionable dashboards. Which dimension strategy avoids high-cardinality explosions?
- City audit chat requires a record whenever a production deploy finishes. How should the pipeline notify that completion?
- Citizen traffic risks being blocked when the city API approaches API Gateway throttle limits or STS session quotas. What should developers alarm on?
- During open enrollment, a benefits Lambda sees many overlapping invokes. How should the developer explain concurrency versus reserved concurrency?
- Profiling a receipt-generation Lambda shows JSON serialization dominating CPU on the hot path. What should the municipal developer do first?
- Load tests must find the smallest Lambda memory setting that still meets p95 latency for a city PDF-merge function. What is the right optimization goal?
- An SNS topic fans citywide alerts, but the parks department Lambda should only process messages tagged department=parks. How should invocations be reduced?
- A multi-lingual citizen portal on CloudFront must vary cache by Accept-Language without disabling caching entirely. What should the developer configure?
- Hot fee-schedule reads hammer Aurora during business hours for a city cashiering app. What application-level change reduces database load?
- CloudWatch shows consistent CPU under-utilization on an ECS OCR service for permit scans. What should the team do?
- p99 latency spikes on a warehouse Lambda align with many synchronous calls to a chatty inventory API. What remediation should the developer propose?
- Structured duration fields in application logs show an external geocoder call is about 80 percent of request time for address validation. What conclusion should operators draw?
- A meter-event consumer invokes Lambda once per SQS message, wasting per-invoke overhead. How should processing be optimized?
- A permit handler runs five separate DynamoDB queries when one keyed access pattern with a wider item (or single query) would suffice. What should the developer change?
- A city Lambda pays TCP/TLS handshake costs on every invoke when creating new HTTP and AWS SDK clients inside the handler. What reuse pattern helps?
- Citizen photo uploads feel slow because thumbnail generation runs on the synchronous upload API path. How should latency be improved?
- An open-data catalog can tolerate roughly two minutes of cache staleness, but election-night results pages need near-zero stale cache. How should cache TTLs be set?
These questions are original practice material and are NOT actual exam questions or brain-dump content. All vendor marks are trademarks of their respective owners. This site is not affiliated with, endorsed by, or sponsored by Amazon Web Services.