A junior city developer asks Amazon Q Developer to draft a Lambda handler skeleton that reads an SQS event and writes to DynamoDB, then reviews the suggestion for secrets and correctness. Which statement is accurate?
Select an answer to reveal the explanation.
Short Explanation
Amazon Q Developer is a helpful pair-programmer in the IDE, not an autopilot with a free pass to prod. Let it draft the SQS-to-DynamoDB skeleton, then you check secrets and logic. The human still owns the merge.
Full Explanation
When a junior city developer asks Amazon Q Developer to draft a Lambda handler skeleton that reads SQS and writes DynamoDB, then reviews the suggestion for secrets and correctness, the accurate statement is that Amazon Q Developer can assist in the IDE with generated code, but the human developer still owns security review and correctness. Generative assistance accelerates boilerplate; it does not transfer accountability for IAM scope, injection flaws, PII handling, or business rules that encode ordinance.
Claiming Q Developer output is guaranteed production-safe with no human review is false and dangerous for public-sector workloads. Q Developer does not replace IAM roles or authorize embedding long-term access keys. Saying Q Developer is out of scope for DVA-C02 and must never appear in workflows is inaccurate relative to modern developer tooling topics the exam may reference; the safe teaching point is assisted generation plus mandatory human review.
Exam caveat: treat AI-generated code like code from an untrusted intern—useful draft, required review. Especially scrutinize credentials, least privilege, and logging of sensitive citizen fields.
Operational check: allow Q Developer for skeletons; require peer or self-review checklists covering secrets, IAM, input validation, and idempotency; run unit tests before merge; and never paste production credentials into prompts.