AWS Certified Developer – Associate — Practice Set 1

Question 1

A developer is building an application that stores user session data. The data must be retrieved in under 1 millisecond and expires automatically after 30 minutes of inactivity. The team wants a fully managed service with no servers to manage. Which AWS service BEST meets these requirements?

Accepted Answer

Amazon ElastiCache for Redis provides sub-millisecond read/write latency for session data and natively supports key-level TTL (time-to-live) for automatic expiration after inactivity. It is fully managed with no server provisioning required. Amazon RDS is a relational database with milliseconds of latency — insufficient for sub-millisecond session access. Amazon DynamoDB offers single-digit millisecond latency but lacks native inactivity-based TTL (it has TTL based on an absolute timestamp). Amazon S3 has much higher latency and no built-in TTL for objects.

Question 2

A developer is writing an AWS Lambda function that needs to send a message to an Amazon SQS queue. The Lambda function runs inside a VPC. The developer wants to ensure the SQS traffic does not traverse the public internet. Which configuration enables this?

Accepted Answer

A VPC endpoint for Amazon SQS (powered by AWS PrivateLink) allows Lambda functions in the VPC to communicate with SQS privately over the AWS network without traversing the public internet or requiring a NAT Gateway. Lambda functions do not have Elastic IPs. A NAT Gateway routes traffic to the internet, which is the opposite of the requirement. Lambda Layers provide additional code and dependencies but do not change VPC network routing.

Question 3

A developer is building an API using Amazon API Gateway and AWS Lambda. During testing, the developer notices that identical API requests within a short timeframe cause duplicate database writes. The developer needs to implement idempotency at the API layer so that retries of the same request do not create duplicate records. Which approach MOST effectively addresses this at the API Gateway level?

Accepted Answer

Storing a unique request hash or idempotency key in Amazon DynamoDB and checking for its existence before processing in the Lambda function is the standard pattern for implementing end-to-end idempotency in serverless APIs. API Gateway caching serves repeated GET requests from cache but does not deduplicate POST requests by design. API Gateway does not natively support an X-Amzn-Idempotency-Key header that prevents duplicate Lambda invocations. Client-side retry with backoff reduces duplicate retries but does not prevent them — the server must handle duplicates at the application layer.

Question 4

A developer is using the AWS SDK for Python (Boto3) to call Amazon DynamoDB. Under sustained traffic, the application receives ProvisionedThroughputExceededException errors. The developer wants to handle these errors gracefully in code. Which SDK feature MOST reduces the need for manual retry logic?

Accepted Answer

The AWS SDK (including Boto3) has a built-in retry mechanism with exponential backoff. Configuring botocore's retry settings (max attempts, retry mode) allows the SDK to automatically retry throttled DynamoDB requests without requiring custom retry logic. Amazon DynamoDB Streams captures item-level changes for event-driven architectures, not for throttling recovery. Amazon DAX is an in-memory write-through cache that reduces read load but does not help with write throttling. Switching to Amazon RDS is a drastic architectural change and does not address throttling patterns.

Question 5

A developer is designing a system where an Amazon S3 upload triggers a series of downstream steps: image resizing, metadata extraction, and database indexing. Each step must run in sequence, and the system must track the state of each step. Which AWS service is MOST appropriate for orchestrating this workflow?

Accepted Answer

AWS Step Functions is purpose-built for orchestrating multi-step workflows with state tracking, error handling, retry logic, and sequential or parallel execution — exactly what this S3-triggered image processing pipeline requires. Amazon SQS chained queues can implement sequential steps but lack native state tracking and error handling across steps. Amazon SNS fans out notifications to multiple subscribers simultaneously (parallel, not sequential) and does not maintain workflow state. Amazon EventBridge routes events to targets but does not orchestrate stateful multi-step sequential workflows.

Question 6

A developer is building a mobile application that requires users to sign in and receive temporary AWS credentials scoped to specific Amazon S3 buckets for uploading profile photos. Which combination of AWS services provides the MOST secure and scalable implementation?

Accepted Answer

Amazon Cognito user pools handle user sign-in and authentication, and Cognito identity pools exchange authenticated user tokens for temporary, scoped AWS credentials via AWS STS — the standard pattern for granting mobile users limited AWS access. Embedding IAM access keys in application code exposes them to extraction and cannot be scoped per user. Creating per-user IAM users is not scalable for mobile applications with potentially millions of users. Using API Gateway with static injected credentials means sharing a single credential across all users, violating least-privilege principles.

Question 7

A developer is building a serverless application with AWS Lambda. The application needs to read from an Amazon Kinesis Data Stream. During testing, the developer observes that when Lambda fails to process a batch of records, the same batch is retried indefinitely, blocking processing of newer records in the shard. Which configuration change MOST effectively resolves this behavior?

Accepted Answer

Setting a maximum retry attempts value prevents infinite retries, bisect-on-error splits a failing batch in half to isolate the problematic record, and configuring a failed-record destination (such as Amazon SQS or Amazon S3) preserves records that cannot be processed — together these break the blocking retry loop without data loss. Increasing Lambda timeout/memory may help if the failure is resource-related but does not address the infinite retry pattern. Enhanced Fan-Out improves Kinesis read throughput but does not control retry behavior on failure. Switching to SQS changes the processing model entirely and SQS Standard does not preserve Kinesis record ordering.

Question 8

A developer needs to implement a shopping cart feature in a web application using Amazon DynamoDB. The cart update must atomically check that a product's inventory count is greater than zero AND decrement it by one — both in a single request, so no other process can decrement below zero concurrently. Which DynamoDB API feature enables this atomic conditional update?

Accepted Answer

DynamoDB UpdateItem with a ConditionExpression executes the attribute decrement atomically only if the specified condition (inventory > 0) is true at the time of the write — preventing the inventory from going below zero without requiring a separate read. DynamoDB BatchWriteItem batches multiple puts and deletes but does not support condition expressions or atomic conditional decrements. DynamoDB TransactWriteItems provides multi-item ACID transactions but adds latency and cost for what is a single-item conditional update. PutItem with optimistic locking uses a version number to detect concurrent modifications, but it replaces the entire item rather than performing an atomic increment/decrement.

Question 9

A developer is writing an AWS Lambda function that needs to retrieve database credentials at runtime. The credentials must be stored securely and never appear in environment variables or source code. The company also requires that credentials are automatically rotated every 30 days. Which AWS service MOST directly meets these requirements?

Accepted Answer

AWS Secrets Manager is specifically designed to store secrets like database credentials and supports automatic rotation on a configurable schedule (including every 30 days) with built-in integration for Amazon RDS, Amazon Redshift, and Amazon DocumentDB. Lambda retrieves secrets at runtime via the Secrets Manager API. AWS Systems Manager Parameter Store can store encrypted secrets but requires custom Lambda code to implement rotation. AWS KMS manages encryption keys, not application-level secrets. Amazon S3 with encryption stores files but has no rotation capability for secrets.

Question 10

A developer is testing an AWS Lambda function locally using the AWS SAM CLI. The function needs to call Amazon DynamoDB. During local testing, the developer must authenticate without using long-term IAM access keys. Which approach is MOST secure for local development?

Accepted Answer

AWS IAM Identity Center with the AWS CLI (v2) allows developers to sign in with their corporate identity and automatically obtain short-lived temporary credentials for the configured AWS profile — the most secure local development pattern. Exporting long-term access keys as environment variables leaves static credentials on the developer's machine, where they can be leaked via shell history or configuration files. Hard-coding keys in Lambda environment variables exposes them in the SAM template or environment and is never appropriate even for testing. A shared IAM user with distributed credentials violates least-privilege and makes credential rotation impossible.

Question 11

A company is building an API with Amazon API Gateway that is accessed by multiple third-party partners. Each partner should only be able to access specific API endpoints based on their contract. The solution must not require changes to the backend Lambda functions. Which Amazon API Gateway feature MOST directly enforces per-partner endpoint access control?

Accepted Answer

API Gateway usage plans associate API keys with specific stages and methods, allowing fine-grained per-partner access to specific endpoints without backend changes. Combined with a Lambda authorizer, the API can validate partner identity and scope per request. Resource policies restrict by source IP or VPC, not by partner-specific API method access. API Gateway caching improves performance, not authorization. AWS WAF filters common attacks and IP-based rules but cannot implement per-partner method-level authorization semantics.

Question 12

A developer is implementing server-side encryption for objects uploaded to Amazon S3. The security policy requires that the encryption key material never leaves AWS, and that the same key is used for all objects in a specific bucket. The developer wants to manage the key rotation policy. Which S3 encryption option BEST meets these requirements?

Accepted Answer

SSE-KMS with a customer managed key (CMK) uses AWS KMS to manage encryption keys that never leave AWS KMS's hardware security modules (HSMs). The customer controls the key policy and can configure automatic annual rotation or on-demand rotation. SSE-S3 uses AWS-managed keys where the customer has no control over rotation policy. SSE-C requires the customer to provide and manage the key material with each request, and the key must be transmitted to AWS — introducing transmission risk. Client-side encryption with a local key means the key lives outside AWS and key management is entirely the customer's responsibility.

Question 13

A developer is implementing an Amazon Cognito-authenticated REST API with Amazon API Gateway. After successful Cognito user pool authentication, the application should call an API endpoint that triggers an AWS Lambda function to return data from an Amazon DynamoDB table. The Lambda function should access DynamoDB using permissions scoped to the authenticated user's Cognito group. Which approach MOST securely implements per-group DynamoDB access?

Accepted Answer

Mapping Cognito user pool groups to IAM roles in the identity pool and having Lambda use AWS STS AssumeRole to assume the appropriate role per group enforces least-privilege DynamoDB access at the IAM level — not in application code. Option A describes part of the flow but passing credentials as event parameters is insecure (they appear in logs). Hard-coding partition keys is fragile and does not enforce IAM-level access control. Granting Lambda full DynamoDB access and implementing logic in code violates least-privilege — a compromised Lambda could access all data.

Question 14

A developer is using the AWS SDK to make requests to AWS services from an Amazon EC2 instance. After rotating the IAM role associated with the instance, the application still returns authentication errors for several minutes. What is the MOST likely cause of this behavior?

Accepted Answer

AWS SDK clients cache temporary credentials obtained from the EC2 instance metadata service (IMDS). When the IAM role is changed, credentials in the SDK's cache may remain valid for a short period (up to a few minutes) until they naturally expire and the SDK fetches fresh credentials. Rebooting the instance is unnecessary — the SDK refreshes credentials automatically before they expire. IAM changes propagate quickly (seconds to minutes), not 24 hours. IAM roles do not require manual activation — once attached, they are immediately available.

Question 15

A developer needs to enforce that all data written to an Amazon S3 bucket is encrypted at rest using AWS KMS. The developer wants to automatically reject any PutObject request that does not include a KMS encryption header. Which mechanism enforces this requirement?

Accepted Answer

A bucket policy with a Deny action on s3:PutObject conditioned on the absence of the x-amz-server-side-encryption: aws:kms request header actively rejects uploads that are not KMS-encrypted, preventing unencrypted data from being stored. Option A denies unencrypted transit (HTTP vs. HTTPS), not KMS encryption at rest. S3 Block Public Access controls public exposure of bucket contents, not encryption enforcement. AWS Config with remediation is a detective and reactive control — unencrypted objects are briefly stored before remediation occurs.

Question 16

A development team wants to automate the deployment of a web application to AWS Elastic Beanstalk every time code is pushed to a specific branch in AWS CodeCommit. Which combination of AWS developer tools creates this CI/CD pipeline with LEAST custom configuration?

Accepted Answer

AWS CodePipeline has native source integrations with AWS CodeCommit (triggering on branch changes) and native deploy integrations with AWS Elastic Beanstalk, requiring minimal custom configuration. A custom Lambda function achieves the same result but requires writing and maintaining code. AWS Amplify is optimized for frontend/full-stack Amplify apps, not arbitrary Elastic Beanstalk environments. AWS CloudFormation deploys infrastructure as code but does not provide continuous deployment triggered by code commits.

Question 17

A company is deploying a new version of a REST API on Amazon API Gateway and AWS Lambda. The team wants to gradually shift 10% of production traffic to the new Lambda version, monitor error rates, and automatically roll back if error rates exceed a threshold. Which deployment strategy supports this automated rollback capability?

Accepted Answer

AWS Lambda weighted aliases allow traffic splitting between Lambda versions, and AWS CodeDeploy linear or canary deployment configurations integrate CloudWatch alarms to automatically roll back traffic to the previous version if error thresholds are exceeded. Deploying as a separate function requires manually managing traffic routing and rollback. Route 53 weighted routing operates at the DNS level for routing between distinct services, not between Lambda versions behind the same API Gateway. Elastic Beanstalk's rolling with additional batch is for EC2-based environments, not Lambda/API Gateway deployments.

Question 18

A developer is using AWS CloudFormation to deploy an application. The CloudFormation template provisions an Amazon RDS database and an Amazon EC2 Auto Scaling group. During a stack update, the developer wants to ensure the EC2 instances only replace after the new RDS schema migration is complete. Which CloudFormation feature enforces this ordering?

Accepted Answer

A CloudFormation WaitCondition combined with cfn-signal allows the stack to pause after the RDS instance is provisioned while waiting for a signal from a schema migration script before proceeding to create EC2 instances. DependsOn ensures CloudFormation provisions RDS before the Auto Scaling group but does not wait for application-level migrations — just the resource creation API call to complete. Mappings define static environment-specific values. Conditions conditionally create resources but do not introduce dynamic dependencies on runtime processes.

Question 19

A developer is packaging an AWS Lambda function and its dependencies for deployment. The function uses several large Python libraries that push the deployment package size to 280 MB uncompressed. AWS Lambda enforces a 250 MB uncompressed deployment package limit. Which approach resolves this size constraint with LEAST operational overhead?

Accepted Answer

Packaging the Lambda function as a container image and publishing it to Amazon ECR allows up to 10 GB of image size, completely eliminating the 250 MB deployment package constraint with no code changes required. Lambda Layers (Option B) also help reduce per-function package size by sharing libraries across functions, but the total layer + function uncompressed size still counts against the 250 MB limit per function (though the total is computed differently and may not resolve the issue for very large packages). Compressing libraries does not reduce the uncompressed size that Lambda measures. Splitting the function adds architecture complexity and may not be feasible if all libraries are needed in one execution.

Question 20

A developer is using AWS SAM to define a serverless application. The application includes an Amazon API Gateway endpoint, an AWS Lambda function, and an Amazon DynamoDB table. The developer wants the DynamoDB table to be retained when the AWS CloudFormation stack is deleted, to prevent accidental data loss. Which SAM/CloudFormation configuration achieves this?

Accepted Answer

Setting DeletionPolicy: Retain on the DynamoDB resource in the CloudFormation/SAM template instructs CloudFormation to leave the table intact when the stack is deleted — the resource is disassociated from the stack but not destroyed. Enabling PITR provides point-in-time backup capability but does not prevent table deletion when the stack is removed. UpdateReplacePolicy: Delete is the default behavior on replacement — it does not protect against stack deletion. Exporting the table ARN makes it referenceable by other stacks but does not protect the table from deletion.

Question 21

A developer needs to pass different database connection strings to an AWS Lambda function for development, staging, and production environments without modifying the function code between deployments. Which approach requires the LEAST code change and LEAST operational overhead?

Accepted Answer

Lambda environment variables allow different configuration values (like connection strings) to be injected per deployment environment without any code changes. Using CloudFormation parameters or SAM environment mappings makes multi-environment management clean and version-controlled. Separate Lambda function versions with hardcoded values require code changes per environment. Hardcoding in source code with conditional logic violates the twelve-factor app principle and requires code changes when values change. Loading configuration from S3 at runtime works but adds latency on cold start and requires S3 permissions and code to fetch the file.

Question 22

A developer's AWS Lambda function is intermittently timing out when processing large payloads. The CloudWatch Logs show the function completes in 28 seconds on average. The current Lambda timeout is set to 30 seconds. Which is the MOST direct action to resolve the timeouts?

Accepted Answer

Before simply increasing the timeout, enabling AWS X-Ray on the Lambda function provides detailed traces showing which segment of the code takes the most time — identifying whether the bottleneck is network I/O, database queries, or computation. This enables targeted optimization. Increasing the timeout and memory (Option A) is a valid quick fix but without understanding the bottleneck, the root cause remains. Lambda functions run in one AZ per invocation — multi-AZ deployment is not applicable. Rewriting in a compiled language is expensive engineering effort and should only be considered after profiling identifies a CPU-bound bottleneck.

Question 23

A developer is troubleshooting intermittent 502 Bad Gateway errors from an Amazon API Gateway endpoint backed by an AWS Lambda function. The errors appear under high load. The Lambda function is not showing errors in CloudWatch Logs during the same time period. Which is the MOST likely cause of these 502 errors?

Accepted Answer

When Lambda hits its concurrency limit (either account-level or reserved concurrency), invocations are throttled and Lambda returns a TooManyRequestsException. API Gateway translates unhandled Lambda invocation errors (including throttles) as 502 Bad Gateway. Because the throttled invocations are not executed, no CloudWatch Logs entries appear for them. API Gateway throttling at its own limit returns 429 (Too Many Requests), not 502. A response payload exceeding 6 MB returns 502, but this would appear consistently for large responses, not intermittently under load. CloudFront is not mentioned in this architecture.

Question 24

A developer notices that an Amazon DynamoDB table's write throughput is concentrated on a single partition, causing hot partition throttling. The table uses a product category ID as the partition key. During sales events, 80% of writes go to the 'Electronics' category. Which design change MOST effectively resolves the hot partition issue?

Accepted Answer

Write sharding by appending a random suffix to the partition key distributes writes across N logical partitions (e.g., Electronics_1 through Electronics_10), eliminating the hot partition. Reads must then scatter-gather across all suffix variants and merge results. Switching to On-Demand capacity prevents capacity throttling errors but does not solve hot partition throttling at the storage partition level — even on-demand tables have per-partition throughput limits. DynamoDB Streams captures change events but has no impact on write throughput distribution. Increasing WCUs helps if the table is uniformly loaded but cannot resolve hot partition limits that are per-physical-partition, not per-table.

Question 25

A developer has enabled AWS X-Ray tracing on an application consisting of Amazon API Gateway, AWS Lambda, and Amazon DynamoDB. In the X-Ray service map, the developer sees a high number of faults (5xx errors) originating from DynamoDB. The DynamoDB segments show ProvisionedThroughputExceededException. Which combination of actions MOST effectively resolves these faults while maintaining cost efficiency?

Accepted Answer

Switching to On-Demand capacity mode eliminates ProvisionedThroughputExceededException by automatically scaling to match the traffic pattern, and implementing exponential backoff with jitter in the SDK client handles transient throttles gracefully during scaling transitions — together addressing both the capacity and retry aspects cost-efficiently. Adding ElastiCache for all reads and writes adds significant architectural complexity and is not appropriate for write-heavy DynamoDB patterns. Provisioning maximum throughput is expensive and wasteful for workloads with variable traffic. Replacing DynamoDB with RDS is a major architectural change requiring schema redesign with no guarantee of eliminating the underlying throughput issue.

DVA-C02 — AWS Certified Developer - Associate