AWS DVA-C02 exam pathFree assessment

AWS DVA-C02 Practice Tests That Find Your Weak Spots

4 practice tests, a 65-question timed simulation, and a free assessment.

AWS Certified Developer - Associate

Find your AWS DVA-C02 gaps in 15 minutes.

Learner actions will appear after the current account is confirmed.

Official exam guide updated Dec 12, 2024
Sample report preview

Preview the output before you study

Take a free assessment, see the decisions costing you points, or confirm where to validate breadth next instead of browsing a generic study list.

Sample readiness result680 / 1000

Know where you stand before another full practice test.

Sample top gapApplication performance and troubleshooting

Targeted repair: Fix a focused gap around Lambda execution behavior, deployment configuration, and evidence-driven troubleshooting.

ReportTop gapsPass PlanTargeted repairsUnlocksPractice + Timed Exam
01Answer exam-style questions
02Work your Pass Plan
03Complete the final simulation
Try it

Answer one AWS DVA-C02 question

If you miss it, CramHQ identifies the decision you misunderstood, helps you fix it, then checks whether you can apply it in a different scenario.

A DynamoDB table uses jobId as its partition key and stores millions of jobs. Workers continuously update jobs, whose status is QUEUED, RUNNING, or DONE. A dashboard must page through jobs for any selected status. A GSI keyed only by status experiences throttling while other table capacity remains available. Which change should the developer implement?

  1. Create a GSI partitioned by status#updateHour, with jobId as the sort key; query each relevant hourly bucket for the selected status and combine the results.
  2. Create a GSI partitioned by jobId, with status as the sort key; query the index using the selected status as the sort-key condition.
  3. Create a GSI partitioned by status, with jobId as the sort key; use on-demand capacity so each status key can absorb concurrent updates automatically.
  4. Create a GSI partitioned by status#(hash(jobId) modulo N), with jobId as the sort key; query all N shards for the selected status and merge the paginated results.
Show the explanation

Hashing jobId assigns jobs predictably across multiple key values for each status. The application can retrieve a status by querying its known shards concurrently and merging their pages.

Try it now

Free AWS DVA-C02 practice questions

Eight practice questions from the CramHQ AWS DVA-C02 bank, with answers and explanations. No signup needed. When you are ready, start the free assessment. CramHQ ranks your weak spots across the whole exam by the points they cost, and your Pass Plan starts with the costliest.

Question 1 of 8Development with AWS Services

A team is preparing a small patch to a TypeScript Lambda function whose AWS SDK for JavaScript v3 dependencies are version-locked. Amazon Q Developer proposes changing an existing service call. The IDE reports that one suggested request property is not part of the command input type, although the remaining code is syntactically valid. Existing tests do not exercise this branch. What should the developer do before merging the patch?

  1. Ask Amazon Q Developer to regenerate the call and tests using workspace context, then merge when its unit tests pass and its code review reports no issue.
  2. Invoke the suggested call against a nonproduction resource, then cast the request to the command input type if the invocation succeeds and preserve the call with a regression test.
  3. Inspect the installed SDK package's command model and matching API reference, revise the request to that contract, then add a stubbed unit test and a focused integration test.
  4. Inspect the service's current API model, retain the property if the service documents it, suppress the type error, then add a stubbed unit test and integration test.
Show answer and explanation

Answer: C

This verifies the suggestion against the contract the application actually uses. The unit test controls the client boundary, while the focused integration test confirms that the revised request is serialized and handled as intended.

“AWS SDK for JavaScript v3 dependencies are version-locked”

What to notice

A version-locked SDK makes the installed client model the controlling contract for what the application can type-check and send.

How to decide

Use this as the controlling constraint, then compare generated code and documentation against the SDK version the application actually uses.

If you picked A

Why it is tempting: Workspace context and generated tests can feel like a complete safety check because they use the same project files and produce passing results.

Why it is wrong: Use generated suggestions as assistance, then independently verify request shapes against the installed SDK command model and matching reference.

If you picked B

Why it is tempting: A successful call can look like proof that the property works, and a cast can make the TypeScript error disappear.

Why it is wrong: A type mismatch must be fixed against the installed SDK command input contract; casting should not hide an unsupported request shape.

If you picked D

Why it is tempting: Current AWS service documentation can describe real service capabilities, so it can seem stronger than a local type error.

Why it is wrong: For application code using a version-locked SDK, the installed client command model determines the request shape the code can type-check and serialize.

Question 2 of 8Development with AWS Services

A Node.js Lambda deployment package contains dist/workers/orders.js, which exports reconcile. The function handler is configured as dist/workers/orders.process. CloudWatch Logs shows a top-level initialization message from orders.js before Runtime.HandlerNotFound reports that process is not exported. The tested package cannot be rebuilt for this release. Which change should the developer make?

  1. Set the handler to dist/workers/orders.reconcile, and deploy only the function configuration change.
  2. Set the handler to dist/workers/orders/reconcile.handler, and deploy only the function configuration change.
  3. Set the handler to dist/workers/orders.js.reconcile, and deploy only the function configuration change.
  4. Set the handler to dist/workers/orders.index, and deploy only the function configuration change.
Show answer and explanation

Answer: A

Lambda has already loaded orders.js, so the module path is valid. Selecting its existing reconcile export corrects the handler lookup while preserving the tested deployment package.

“top-level initialization message from orders.js before Runtime.HandlerNotFound reports that process is not exported”

What to notice

This separates module resolution from export lookup: the file loaded, so the handler repair should target the exported function name rather than the module path.

How to decide

Use the log sequence to decide which part of the handler failed, then compare the configured export with the function exported by the loaded file.

If you picked B

Why it is tempting: The word reconcile is visible in the stem, so moving it into the path can seem like a way to point Lambda at the right code.

Why it is wrong: In a Node.js Lambda handler, the path before the final dot identifies the module, and the name after the dot identifies the export.

If you picked C

Why it is tempting: The deployment package contains orders.js, so copying the file extension into the handler string can look precise.

Why it is wrong: For Node.js Lambda handlers, omit the .js extension from the module path and place the exported function name after the dot.

If you picked D

Why it is tempting: index is a familiar default-looking name, and the module path portion remains close to the working path shown by the logs.

Why it is wrong: The handler export name must match the exact exported function in the loaded module.

Question 3 of 8Security

An Amazon ECS task calls an Amazon API Gateway REST API method reserved for workload-to-workload traffic. The method intentionally uses AWS_IAM authorization, and the task role permits execute-api:Invoke. The task sends an HTTPS request carrying a valid OAuth access token, but API Gateway rejects it. Which change should the developer implement?

  1. Retrieve the task role's temporary credentials and use an AWS SDK SigV4 signer for execute-api, preserving the role's execute-api:Invoke permission.
  2. Replace AWS_IAM with an Amazon Cognito user pool authorizer, configure the expected OAuth scopes, and continue sending the access token.
  3. Add an API Gateway resource policy allowing the task role, keep AWS_IAM, and continue sending the unsigned bearer-token request over TLS.
  4. Keep AWS_IAM, configure an API key and usage plan for the task, and send the key with the bearer-token request over TLS.
Show answer and explanation

Answer: A

AWS_IAM authorization authenticates the caller through the SigV4 signature and then evaluates whether that AWS identity may invoke the API. Signing with task-role credentials supplies the identity whose existing execute-api:Invoke permission can be evaluated.

“method intentionally uses AWS_IAM authorization, and the task role permits execute-api:Invoke”

What to notice

This quote establishes that the API is using AWS principal-based authorization and that the ECS task role already has the invoke permission, so the missing requirement is authenticating the request as that role.

How to decide

Treat AWS_IAM as the controlling authorization type. Separate token validation from AWS principal authentication, then choose the change that lets API Gateway evaluate the task role's permission.

If you picked B

Why it is tempting: Cognito user pool authorizers can validate OAuth access tokens and scopes for application callers.

Why it is wrong: Use a Cognito user pool authorizer for token-based application callers; use AWS_IAM with SigV4-signed AWS-credential requests for AWS principals.

If you picked C

Why it is tempting: A resource policy that names the task role sounds related because the task role is the intended AWS principal.

Why it is wrong: A resource policy can restrict or allow access for identified principals, but AWS_IAM still needs a SigV4-signed request to authenticate the caller.

If you picked D

Why it is tempting: API keys are sent with API Gateway requests and are associated with clients, so they can look like an authentication mechanism.

Why it is wrong: API Gateway API keys support usage-plan identification, metering, and throttling; they do not replace SigV4 authentication for AWS_IAM.

Show all 8 practice questions
Question 4 of 8Security

A CloudFront distribution uses a custom domain and an HTTPS Application Load Balancer origin in eu-west-1. A public ACM certificate in eu-west-1 covers the custom domain, but it does not appear when the developer configures viewer HTTPS. The origin already has a certificate matching its own hostname and must remain unchanged. What should the developer do?

  1. Reference the eu-west-1 certificate ARN in an AWS CloudFormation distribution update, and retain the load balancer certificate.
  2. Request a replacement public certificate in eu-west-1 for the custom domain, attach it to the distribution, and retain the load balancer certificate.
  3. Request or import a public certificate for the custom domain in us-east-1, attach it to the distribution, and retain the load balancer certificate.
  4. Use the default CloudFront certificate for viewer HTTPS, keep the custom domain as an alternate domain name, and retain the load balancer certificate.
Show answer and explanation

Answer: C

CloudFront requires ACM certificates used for viewer HTTPS to reside in us-east-1. The load balancer's regional certificate continues securing the separate connection from CloudFront to the origin.

“A public ACM certificate in eu-west-1 covers the custom domain, but it does not appear when the developer configures viewer HTTPS”

What to notice

This points to viewer-side CloudFront certificate eligibility, not a problem with the HTTPS origin certificate.

How to decide

Separate the viewer HTTPS certificate from the origin TLS certificate, then check the managed certificate placement rule for the viewer side.

If you picked A

Why it is tempting: Supplying an ARN directly can look more precise than selecting a certificate in the console.

Why it is wrong: CloudFormation uses the same CloudFront validation rules as other configuration paths; it cannot make an ineligible ACM viewer certificate valid.

If you picked B

Why it is tempting: The origin and existing certificate are both in eu-west-1, so replacing the certificate there can feel regionally consistent.

Why it is wrong: For CloudFront viewer HTTPS with a custom domain, the viewer certificate must satisfy CloudFront's certificate placement rule regardless of the origin's Region.

If you picked D

Why it is tempting: The default certificate is built into CloudFront, so it can look like the simplest managed certificate option.

Why it is wrong: The default CloudFront certificate covers the CloudFront-assigned domain name, not your custom domain.

Question 5 of 8Deployment

A Python 3.12 AWS Lambda function uses an AWS base container image. Its Dockerfile copies app.py to ${LAMBDA_TASK_ROOT} and sets CMD ["app.process"]. The file defines handler(event, context), and importing app inside the built image succeeds. Deployment completes, but each invocation returns Runtime.HandlerNotFound: Handler 'process' missing on module 'app'. Which change should the developer make?

  1. Copy app.py to /opt/python, keep CMD ["app.process"], rebuild and redeploy the image.
  2. Rebuild the image for arm64, keep CMD ["app.process"], change the Lambda architecture to arm64, and redeploy.
  3. Set the Dockerfile CMD to ["app.handler"], rebuild and push the image, then update the function to use the new image.
  4. Keep CMD ["app.process"], increase the function memory and timeout, then deploy a new function version.
Show answer and explanation

Answer: C

The module is already discoverable, and app.py exports handler. Setting CMD to app.handler supplies the runtime interface with the existing module and callable.

“The file defines handler(event, context), and importing app inside the built image succeeds”

What to notice

This proves the code file is discoverable and shifts the decision from file placement to the callable selected by the Lambda handler string.

How to decide

Separate module discovery from callable selection, then compare the handler string with the function name exported by the module.

If you picked A

Why it is tempting: Changing the code path can seem plausible because Lambda packaging errors often come from misplaced files.

Why it is wrong: If Lambda imports the module and then reports a missing callable, fix the handler string or exported function name, not the module location.

If you picked B

Why it is tempting: Architecture changes can matter for Lambda container images, so arm64 can look like a deployment fix.

Why it is wrong: Architecture fixes image compatibility; it does not change which module function the Lambda runtime invokes.

If you picked D

Why it is tempting: Memory and timeout are common Lambda troubleshooting levers when invocations fail.

Why it is wrong: Memory and timeout affect execution capacity and duration after the runtime can invoke the handler; they do not select the handler callable.

Question 6 of 8Deployment

Amazon Q Developer generates 80 unit tests for a Lambda function behind an API. The build now takes twice as long, although line coverage is high. Review shows many tests change only a request label, traverse the same branch, and assert the same result. The function's contract also differentiates malformed payloads, repeated requests, and downstream timeouts through response details or side effects. Which action should the developer take before merging the tests?

  1. Map each generated test to a contract outcome; retain cases with outcome-specific assertions for every distinct branch, then parameterize or delete label-only duplicates.
  2. Select generated tests solely by incremental line coverage, retain those reaching new lines, and delete tests that add no lines even when they verify different outcomes.
  3. Keep every generated label variation, convert them to a parameterized test, and retain the shared success assertion because broader input enumeration provides stronger regression protection.
  4. Group generated tests by returned HTTP status, keep the shortest case for each status, and consolidate cases sharing a status regardless of response body or side effects.
Show answer and explanation

Answer: A

This preserves evidence for each distinct contract path while removing cases that prove nothing new. It addresses the longer build without sacrificing checks for the differentiated responses and side effects.

“The function's contract also differentiates malformed payloads, repeated requests, and downstream timeouts through response details or side effects.”

What to notice

This cue makes contract outcomes the controlling evidence boundary for test retention, not just code execution or a coarse response category.

How to decide

Identify every observable behavior the contract distinguishes, then check which option preserves assertions for those differences while removing only true duplicates.

If you picked B

Why it is tempting: Line coverage is visible, measurable, and the stem says coverage is high, so it can look like the natural cleanup metric.

Why it is wrong: Line coverage shows execution, but generated tests also need assertions that verify each distinct contract outcome and observable side effect.

If you picked C

Why it is tempting: Parameterized tests look clean and broad input enumeration can feel like better coverage.

Why it is wrong: Parameterization removes duplicated test code, but it does not make label-only cases valuable when they traverse the same branch and assert the same result.

If you picked D

Why it is tempting: Grouping by status sounds systematic and can quickly reduce a generated test suite.

Why it is wrong: For API tests, keep separate generated cases when the contract distinguishes body details, headers, state changes, or side effects, even if the HTTP status matches.

Question 7 of 8Troubleshooting and Optimization

After a deployment, a VPC-connected AWS Lambda function successfully reads an item from a DynamoDB table but fails when saving changes. CloudWatch Logs shows the failure after 35 ms: AccessDeniedException: the assumed execution-role ARN is not authorized to perform dynamodb:UpdateItem on the table ARN because no identity-based policy allows the action. The function timeout is 10 seconds. Which action should the developer take?

  1. Classify the failure as throttling; increase the Lambda timeout and configure exponential-backoff retries while leaving the execution role unchanged.
  2. Classify the failure as authorization; allow dynamodb:UpdateItem on the table ARN in the Lambda execution role's identity-based policy.
  3. Classify the failure as request validation; revise the UpdateExpression and attribute mappings while leaving the execution role unchanged.
  4. Classify the failure as VPC reachability; create a DynamoDB gateway endpoint and update its route-table associations while leaving the execution role unchanged.
Show answer and explanation

Answer: B

The execution-role ARN is the principal making the request, and the exception explicitly identifies its missing permission. Granting only dynamodb:UpdateItem for the target table corrects the failure with least privilege.

“AccessDeniedException: the assumed execution-role ARN is not authorized to perform dynamodb:UpdateItem on the table ARN because no identity-based policy allows the action”

What to notice

This wording identifies the principal, action, resource, and missing identity-based allow, so the controlling issue is authorization rather than timeout, validation, or network path.

How to decide

Use the error fields to classify the failure first: principal, denied operation, target resource, and policy type.

If you picked A

Why it is tempting: Backoff and longer timeouts are common fixes for throttling, and the stem includes a timeout value.

Why it is wrong: Use throttling remedies only when the failure signal is a throttling-specific exception or rate-limit response.

If you picked C

Why it is tempting: Update expressions and attribute mappings are common causes of DynamoDB write failures.

Why it is wrong: Classify request-validation problems from validation errors, malformed expression messages, or parameter-specific diagnostics.

If you picked D

Why it is tempting: VPC-connected Lambda functions often need careful network paths to reach AWS services.

Why it is wrong: Treat network reachability as the root cause when the evidence shows connection failure, timeout, DNS failure, or no service response.

Question 8 of 8Troubleshooting and Optimization

An application publishes a custom failure metric to CloudWatch. Alarm history shows the existing alarm transitioned from OK to ALARM as expected. Its ALARM configuration lists the intended Amazon SNS topic, and a direct test message reaches the subscriber. The alarm configuration shows that its actions are disabled. Which change should a developer make to restore notifications with the smallest scope?

  1. Create a replacement Amazon SNS topic and subscription, then update the existing alarm action to reference the new topic.
  2. Call CloudWatch EnableAlarmActions for the existing alarm; retain its current metric, threshold, and Amazon SNS action.
  3. Increase the application's failure log level, create a CloudWatch Logs metric filter, and replace the alarm's current metric with the filter metric.
  4. Call PutMetricAlarm to recreate the alarm against a newly named custom metric; retain the current Amazon SNS topic.
Show answer and explanation

Answer: B

EnableAlarmActions reactivates the alarm's configured actions. This directly addresses the disabled setting while preserving the metric evaluation and Amazon SNS path that the evidence shows are working.

“The alarm configuration shows that its actions are disabled.”

What to notice

This identifies the controlling failure point as alarm action invocation, not metric publishing or SNS delivery.

How to decide

Treat this as the decisive constraint. Preserve components already proven to work and select the smallest change that reactivates the disabled alarm behavior.

If you picked A

Why it is tempting: SNS is the delivery service, so rebuilding the topic can look like the smallest notification repair.

Why it is wrong: If direct SNS delivery works and the alarm action is disabled, restore the alarm's action invocation setting rather than replacing the SNS target.

If you picked C

Why it is tempting: Creating a log metric filter sounds like a stronger observability pipeline when alerts are not arriving.

Why it is wrong: Do not replace metric instrumentation when the alarm history proves the current metric and threshold already drive the expected state change.

If you picked D

Why it is tempting: PutMetricAlarm can configure alarms and actions, so recreating the alarm can look like a comprehensive reset.

Why it is wrong: When the existing alarm transitions correctly, keep the current metric and alarm evaluation path and fix the disabled action setting directly.

CramHQ links wrong answers to the mistake behind them. Start with the free assessment, and CramHQ keeps finding your gaps as you practice and adds a repair for each to your Pass Plan.

Start the free AWS DVA-C02 assessment

Why study with CramHQ

Find the DVA-C02 choices behind slow starts.

Start with the free AWS Developer Associate assessment. CramHQ uses your result to rank the next step, explain the decisions that matter, and check you again.

Learner actions will appear after the current account is confirmed.

  1. A clear next step, chosen for you

    The Pass Plan ranks gaps by the points they cost and opens the top repair.

  2. Understand why an answer works

    The reasoning behind the right answer and where the alternatives break.

  3. Prove it on a retest

    A fresh question on the same decision verifies the gap is closed.

  4. Track it on your readiness map

    Strengthened areas change colour; pick the next priority from what is left.

  • Flashcards saved from your repairs
  • Optional hints when you are stuck
  • Timed simulations at exam pace
Exam syllabus

Exam-weighted coverage.

Coverage follows the published AWS DVA-C02 skill areas measured as of Dec 12, 2024, so your practice stays aligned.

Development with AWS Services

32%

21 concepts

Security

26%

16 concepts

Deployment

24%

17 concepts

Troubleshooting and Optimization

18%

14 concepts

Official AWS exam changes

AWS exam update history

Changes recorded from official AWS exam sources.

Published Dec 12, 2024Major updateAWS added developer skills for Amazon Q, event-driven systems, resilient integrations, application security, testing, and performance.Integrated by CramHQ

Compared with Exam guide version 2.0

Added

  • Amazon Q Developer and event-driven application skills
  • Resilient integration, authorization, and multi-tenant security skills
  • Additional testing, health-check, caching, and performance skills

Changed

  • Knowledge and skills were consolidated under each task.
  • Integration testing, deployment strategy, logging, and service scope were updated.

Removed

  • AWS Copilot and Amazon CodeGuru were removed from the in-scope service list.
Updated

CramHQ completed the DVA-C02 update for AWS exam guide version 2.1, including the expanded development, security, and testing scope.

View official source
Effective Feb 28, 2023Major updateAWS reorganized DVA-C02 into four domains and updated data-store, security, testing, and deployment coverage.Integrated by CramHQ

Compared with DVA-C01

Changed

  • AWS reorganized DVA-C02 into four domains and updated data-store, security, testing, and deployment coverage.
Updated

CramHQ integrated the AWS-DVA-C02 update into this course.

View official source
Published Jun 10, 2018Major updateAWS restructured the Developer Associate exam around five domains and current services and best practices.Integrated by CramHQ

Compared with Previous Developer Associate exam

Changed

  • AWS restructured the Developer Associate exam around five domains and current services and best practices.
Updated

CramHQ integrated the AWS-DVA-C02 update into this course.

View official source
Practice and validate

Build breadth before the timed simulation.

Use separate exam-style practice quizzes to validate breadth, review explanations and your answers, use hints when stuck, and build confidence before the timed simulation, with an optional timer.

4 Practice Quizzes

01Practice quiz

AWS DVA-C02 Practice Quiz 1

Questions
65
Timer
Optional
02Practice quiz

AWS DVA-C02 Practice Quiz 2

Questions
65
Timer
Optional
03Practice quiz

AWS DVA-C02 Practice Quiz 3

Questions
65
Timer
Optional
04Practice quiz

AWS DVA-C02 Practice Quiz 4

Questions
65
Timer
Optional
Timed readiness check

Check readiness under timed conditions.

Use this after practice when you want an exam-style pacing, stamina, and breadth check.

FinalReadiness simulation
CramHQ target720 / 1000

AWS DVA-C02 Final Readiness Simulation

Questions
65
Time
130 min
Mode
Timed

Start with the free assessment; full Pass Plan access unlocks the timed exam simulation.

Question formats

Practice the formats this exam path supports.

CramHQ shows the interaction patterns available for AWS DVA-C02 from the active exam path inventory.

Single answer

Choose the best answer from exam-style options.

Multi-answer

Select every correct option when more than one applies.

Exam integrity

Original practice, aligned to public objectives.

CramHQ helps you practice the decisions behind AWS DVA-C02 without using copied or confidential exam content.

Practice contentOriginal questions

Original practice questions aligned to public exam objectives.

Coverage sourcePublic objectives

Coverage is checked against the published exam objectives.

Provider relationshipIndependent prep
AWS DVA-C02 exam guide

CramHQ is independent and is not affiliated with AWS.

Quick answers

AWS DVA-C02 practice test questions, answered.

Do I need to sign up?

No. You can start the assessment and review your report before creating an account. Sign up when you want to save the report and continue the Pass Plan.

Is the report free?

Yes. The assessment, readiness report, and your first targeted repair are free.

Are these copied exam questions or dumps?

No. CramHQ uses original practice items designed to test the decisions and concepts behind the exam.

Is CramHQ affiliated with AWS?

No. CramHQ is independent and is not endorsed by AWS.

What do I get after the assessment?

Save your report to keep the Pass Plan, fix your first gap free, and unlock the full Pass Plan when you want every repair, practice quizzes, and timed simulation.

I have already studied a lot. Is this still worth it?

That is exactly who it is built for. CramHQ keeps tracking the last few gaps between you and a comfortable pass, the ones a raw score hides, and puts the one costing you the most points at the top of your Pass Plan.

How long do I get access?

12 months of full access from purchase, with room to come back after a break.

What is your refund policy?

Paid exam paths come with a 7-day money-back guarantee. Conditions apply; see the Refund Policy. You can also try the assessment and your first repair free before you buy. Refund Policy

More exam paths

Choose the next certification path that fits your current goal.