AWS Developer Associate Exam Flashcards

Q: Is the AWS Developer Associate (DVA-C02) exam multiple choice?

Yes. The DVA-C02 uses multiple-choice (one correct answer) and multiple-response (two or more correct answers) questions. There are 65 questions total, of which 50 are scored and 15 are unscored pretest items that do not affect your result.

Q: What score do I need to pass the AWS Developer Associate exam?

You need a scaled score of 720 on a 100-1000 scale. The exam uses a compensatory model, so you only need to pass the overall exam, not each individual domain.

Q: What are the four domains of the DVA-C02 exam?

Development with AWS Services (32%), Security (26%), Deployment (24%), and Troubleshooting and Optimization (18%). Development is the largest domain and emphasizes serverless and SDK-based application code.

Q: How long is the AWS Developer Associate exam and what does it cost?

The exam runs 130 minutes and costs 150 USD. The certification is valid for 3 years, after which you recertify by passing the current version or a higher-level AWS certification.

Q: What experience does AWS recommend before taking DVA-C02?

AWS recommends about 1 or more years of hands-on experience developing and maintaining AWS-based applications, plus proficiency in at least one high-level programming language. There is no formal prerequisite.

Q: Are these AWS Developer flashcards free?

Yes. All 50 OpenExamPrep AWS Developer Associate flashcards are free, with no signup required, and are aligned with the current DVA-C02 exam guide for 2026.

Question 1

AWS Lambda concurrency: reserved vs provisioned

Accepted Answer

Reserved concurrency caps and guarantees the maximum number of simultaneous executions for a function (and isolates it from other functions). Provisioned concurrency pre-initializes a set number of execution environments so they are warm and respond with no cold-start latency. Reserved controls how many can run; provisioned controls how many are already warm.

Question 2

Lambda cold start

Accepted Answer

A cold start is the added latency when Lambda must create a new execution environment (download code, start the runtime, run init code) before handling an event. Reduce it with provisioned concurrency, smaller deployment packages, and by initializing SDK clients and connections outside the handler so they are reused across warm invocations.

Question 3

Lambda key limits: timeout, /tmp storage, and payload

Accepted Answer

Maximum function timeout is 900 seconds (15 minutes). Ephemeral /tmp storage is configurable from 512 MB up to 10,240 MB (10 GB). Invocation payload limit is 6 MB for synchronous calls and 256 KB for asynchronous calls. For long-running or large-data work, offload to Step Functions, ECS/Fargate, or S3.

Question 4

Lambda synchronous vs asynchronous invocation

Accepted Answer

Synchronous (RequestResponse): caller waits for the result and handles errors/retries itself (e.g., API Gateway). Asynchronous (Event): Lambda queues the event, returns immediately, retries on failure (default two retries), and can route failures to a dead-letter queue or destination. Choose async to decouple and absorb spikes; choose sync when you need the response.

Question 5

Lambda environment variables for secrets

Accepted Answer

Environment variables pass configuration to a function and are encrypted at rest with KMS. For sensitive values, reference Secrets Manager or SSM Parameter Store at runtime rather than baking secrets into plaintext env vars, and use a customer-managed KMS key when you need encryption-in-transit to the console and tighter access control.

Question 6

Lambda layers

Accepted Answer

A layer is a .zip archive of libraries, a custom runtime, or other dependencies that you attach to functions to share code and shrink deployment packages. A function can use up to five layers, and the total unzipped size of function plus layers must stay within the deployment package quota. Layers promote reuse and faster deploys.

Question 7

API Gateway: REST API vs HTTP API

Accepted Answer

REST APIs offer the full feature set: usage plans/API keys, request/response transformation, AWS WAF, caching, and edge-optimized endpoints. HTTP APIs are lower latency, lower cost, and simpler, built for Lambda and HTTP backends with JWT/OIDC auth. Choose HTTP API for cost-sensitive proxy APIs; choose REST when you need its advanced features.

Question 8

API Gateway throttling and usage plans

Accepted Answer

API Gateway protects backends with account-level and per-method throttling using a token-bucket model (a steady rate plus a burst limit); exceeding it returns HTTP 429. Usage plans tie API keys to rate and quota limits so you can meter and tier different consumers. Throttling is about protecting capacity; usage plans are about monetizing/limiting clients.

Question 9

API Gateway integration: proxy vs non-proxy

Accepted Answer

Lambda proxy integration passes the entire raw request to the function and expects a specific JSON response shape, leaving mapping to your code. Non-proxy (custom) integration uses mapping templates (VTL) to transform requests and responses in API Gateway itself. Proxy is simpler and flexible; non-proxy lets you decouple the API contract from the backend.

Question 10

API Gateway caching

Accepted Answer

API Gateway can cache endpoint responses in a dedicated cache cluster keyed by request parameters, reducing calls to the backend and improving latency. You set a TTL, and clients can bypass the cache with a Cache-Control header if authorized. Caching is enabled per stage and is billed by cache size, so it is a deliberate cost/performance trade-off.

Question 11

DynamoDB capacity modes: on-demand vs provisioned

Accepted Answer

On-demand scales automatically and bills per request, ideal for unpredictable or spiky/new workloads with no capacity planning. Provisioned sets read/write capacity units you pay for regardless of use, cheaper for steady, predictable traffic, and can use auto scaling. Pick on-demand for unknown patterns; pick provisioned (optionally with reserved capacity) for stable, high-volume traffic.

Question 12

DynamoDB partition key design

Accepted Answer

DynamoDB distributes data across partitions by hashing the partition key, so a high-cardinality, evenly-accessed key avoids hot partitions and throttling. A poor key (few values or one very popular value) concentrates traffic and causes throttling even when total capacity is sufficient. Good key design, not just more capacity, is the fix for hot keys.

Question 13

DynamoDB single-table design

Accepted Answer

Single-table design stores multiple entity types in one table, using composite keys and overloaded GSIs so related items can be fetched in one query. It minimizes round trips and avoids cross-table joins (which DynamoDB lacks), but requires modeling access patterns up front. The goal is to satisfy each access pattern with a single, efficient query.

Question 14

DynamoDB GSI vs LSI

Accepted Answer

A Global Secondary Index has its own partition/sort key and its own capacity, can be created anytime, and is eventually consistent. A Local Secondary Index shares the table's partition key with an alternate sort key, must be created at table creation, and supports strongly consistent reads. Use a GSI for new access patterns; use an LSI for alternate sorts within the same partition.

Question 15

DynamoDB Query vs Scan

Accepted Answer

Query retrieves items by a specific partition key (optionally narrowing by sort key) and reads only matching items, so it is efficient. Scan reads every item in the table or index and then filters, consuming capacity proportional to table size. Prefer Query (or a GSI) for predictable access; treat Scan as a last resort for full-table reads.

Question 16

DynamoDB read consistency: eventual vs strong

Accepted Answer

Eventually consistent reads (default) may briefly return stale data right after a write but cost half a read capacity unit. Strongly consistent reads always reflect the latest committed write but cost a full RCU and are not available on GSIs. Choose strong consistency only when reading your own recent writes matters; eventual is cheaper and higher throughput.

Question 17

DynamoDB Streams

Accepted Answer

DynamoDB Streams captures an ordered, time-sequenced log of item-level changes (insert/modify/remove) that you can process with Lambda or Kinesis. It enables change-data-capture patterns such as replication, aggregation, and triggering downstream workflows. Records are kept for 24 hours; you choose what the stream view includes (keys only, new image, old image, or both).

Question 18

DynamoDB optimistic locking with version numbers

Accepted Answer

Optimistic locking adds a version attribute and uses a conditional write that succeeds only if the stored version still matches the one you read. If another client updated the item first, the condition fails and you retry with fresh data, preventing lost updates without holding locks. It is the standard way to avoid overwriting concurrent changes in DynamoDB.

Question 19

S3 storage classes overview

Accepted Answer

S3 Standard suits frequently accessed data; Standard-IA and One Zone-IA cost less for infrequent access (One Zone trades durability across AZs); Glacier classes (Instant/Flexible/Deep Archive) are cheapest for archival with increasing retrieval times. Intelligent-Tiering moves objects automatically based on access patterns. Match the class to access frequency and retrieval-time tolerance to optimize cost.

Question 20

S3 multipart upload

Accepted Answer

Multipart upload splits a large object into parts uploaded in parallel and then assembled, improving throughput and resilience (failed parts retry independently). AWS recommends it for objects over 100 MB and requires it above 5 GB for a single PutObject. Configure a lifecycle rule to abort incomplete multipart uploads so abandoned parts do not accrue storage cost.

Question 21

S3 presigned URLs

Accepted Answer

A presigned URL grants temporary, time-limited access to a specific S3 object using the signer's credentials, so clients can upload or download directly without their own AWS permissions or exposing the bucket. The URL inherits the creator's permissions and expires after a set duration. Use it for secure, direct browser uploads/downloads without proxying data through your app.

Question 22

SQS standard vs FIFO queues

Accepted Answer

Standard queues offer nearly unlimited throughput, at-least-once delivery, and best-effort ordering (duplicates and reordering possible). FIFO queues guarantee exactly-once processing and strict ordering within a message group, with limited throughput (300 messages/second, or 3,000 with batching). Use FIFO when order or de-duplication is required; use standard for maximum scale.

Question 23

SQS visibility timeout and dead-letter queues

Accepted Answer

When a consumer receives a message, the visibility timeout hides it from other consumers until it is deleted or the timeout expires (default 30 seconds, max 12 hours). If processing keeps failing past the maxReceiveCount, a redrive policy moves the message to a dead-letter queue for inspection. This prevents one poison message from blocking the queue.

Question 24

SQS long polling vs short polling

Accepted Answer

Short polling returns immediately, sampling a subset of servers, so it can return empty responses even when messages exist and generates more (costlier) empty receives. Long polling (WaitTimeSeconds up to 20) waits for a message to arrive before responding, reducing empty receives and API costs. Long polling is the recommended default for efficient consumers.

Question 25

SNS vs SQS vs EventBridge

Accepted Answer

SNS is pub/sub push: one message fans out to many subscribers (Lambda, SQS, HTTP, email). SQS is a pull-based buffer that decouples and durably stores messages for one consumer group. EventBridge is an event bus that routes events by content-based rules to many targets and integrates with SaaS and AWS services. Combine SNS+SQS (fan-out) for durable parallel delivery.

Question 26

Step Functions: Standard vs Express workflows

Accepted Answer

Standard workflows are durable, long-running (up to one year), exactly-once, and billed per state transition, suited to orchestration and human-in-the-loop. Express workflows are short-lived (up to five minutes), high-volume, at-least-once, and billed by execution count/duration, suited to high-throughput event processing. Choose by duration, volume, and exactly-once needs.

Question 27

ECS launch types: EC2 vs Fargate

Accepted Answer

With the EC2 launch type you provision and manage the container host instances (more control, responsible for patching/scaling the cluster). With Fargate, AWS runs containers serverlessly with no instances to manage; you pay per task vCPU/memory. Choose EC2 for fine-grained control or specialized instances; choose Fargate to avoid managing infrastructure.

Question 28

ECS task role vs task execution role

Accepted Answer

The task role grants permissions to the application code running inside the container (e.g., reading from S3 or DynamoDB). The task execution role grants the ECS agent permissions to pull images from ECR and write logs to CloudWatch on your behalf. Keep them separate so application permissions follow least privilege independent of platform plumbing.

Question 29

Amazon ECR

Accepted Answer

Elastic Container Registry is a managed, private Docker/OCI image registry integrated with IAM for access control and with ECS/EKS/Lambda for image pulls. Authenticate the Docker client with a token from the ECR API/CLI before pushing or pulling. Use lifecycle policies to expire old images and image scanning to detect vulnerabilities in stored images.

Question 30

Cognito user pools vs identity pools

Accepted Answer

A user pool is a user directory that handles sign-up, sign-in, MFA, and issues JWT tokens (authentication). An identity pool (federated identities) exchanges those tokens or third-party logins for temporary AWS credentials so users can call AWS services directly (authorization to AWS resources). Use a user pool to authenticate users; add an identity pool to grant them AWS access.

Question 31

AWS SDK retries and exponential backoff

Accepted Answer

AWS SDKs automatically retry throttled or transient errors using exponential backoff with jitter, increasing the wait between attempts to avoid hammering a stressed service. You can tune the maximum retry count and timeouts. Treat HTTP 429/ProvisionedThroughputExceeded and 5xx as retryable; design idempotent operations so retries are safe.

Question 32

AWS SDK pagination

Accepted Answer

List/Query/Scan APIs return results in pages with a continuation token (NextToken or LastEvaluatedKey); you must loop, passing the token back, until none is returned to get all results. SDK paginators automate this. Forgetting pagination is a common bug that silently returns only the first page of data.

Question 33

Idempotency in distributed AWS applications

Accepted Answer

An idempotent operation produces the same result whether executed once or many times, which is essential because SQS, async Lambda, and SDK retries can deliver or invoke more than once. Achieve it with de-duplication keys, conditional writes, or tracking processed message IDs. Without idempotency, retries cause duplicate side effects like double charges.

Question 34

AWS AppConfig

Accepted Answer

AppConfig (part of Systems Manager) manages and safely deploys application configuration and feature flags separately from code, with validators and gradual rollout plus automatic rollback on alarms. Applications poll for the latest configuration at runtime. It lets you change behavior or toggle features without redeploying, reducing risk compared to hard-coded config.

Question 35

IAM roles vs users vs policies

Accepted Answer

An IAM user is a long-term identity with credentials for a person or app; a role is an identity assumed temporarily that delivers short-lived credentials (preferred for services and cross-account access). Policies are JSON documents attached to identities or resources that allow or deny actions. Best practice: use roles and temporary credentials instead of long-lived user keys.

Question 36

IAM policy evaluation: explicit deny wins

Accepted Answer

IAM evaluates a request by combining all applicable policies: an explicit Deny always overrides any Allow, and with no matching Allow the default is an implicit deny. So access requires at least one Allow and no Deny across identity, resource, permission boundary, and SCP policies. Remember the order: explicit deny beats everything else.

Question 37

STS AssumeRole and temporary credentials

Accepted Answer

AWS STS issues short-lived credentials (access key, secret, session token) when an identity assumes a role, scoped by the role's permissions and an expiration. This avoids embedding long-term keys and enables cross-account access and identity federation. EC2/ECS/Lambda use roles so the SDK automatically retrieves and rotates these temporary credentials.

Question 38

KMS envelope encryption

Accepted Answer

Envelope encryption uses a KMS customer master key (KMS key) to encrypt a data key, which in turn encrypts your actual data. You store the encrypted data key beside the ciphertext and call KMS Decrypt only to unwrap the data key, so large payloads are encrypted locally without sending them to KMS. This is how S3 SSE-KMS and the AWS Encryption SDK work.

Question 39

Secrets Manager vs SSM Parameter Store

Accepted Answer

Both store configuration/secrets securely, but Secrets Manager adds built-in automatic rotation (e.g., RDS credentials) and cross-region replication, at a per-secret cost. Parameter Store is free for standard parameters and integrates tightly with other services; SecureString parameters use KMS. Use Secrets Manager when you need automatic rotation; Parameter Store for general config and cost-sensitive secrets.

Question 40

CloudFormation vs AWS SAM

Accepted Answer

CloudFormation is the general infrastructure-as-code service using JSON/YAML templates with full resource coverage. SAM is a CloudFormation extension with concise shorthand for serverless apps (functions, APIs, tables) plus a CLI to build, locally test, and deploy. SAM transforms into standard CloudFormation at deploy time; use it to write less boilerplate for serverless stacks.

Question 41

CloudFormation change sets and drift detection

Accepted Answer

A change set previews exactly which resources an update will add, modify, or delete before you execute it, preventing surprise replacements. Drift detection reports where deployed resources have diverged from the template (e.g., manual console edits). Together they keep stack updates safe and your infrastructure in sync with code.

Question 42

CodeDeploy: in-place vs blue/green deployment

Accepted Answer

In-place updates the existing instances one batch at a time (lower cost, brief reduced capacity, slower rollback). Blue/green provisions a new (green) environment, shifts traffic to it, and keeps the old (blue) for instant rollback by re-pointing traffic. Choose blue/green for zero-downtime and fast rollback; in-place when you cannot duplicate infrastructure.

Question 43

CodeDeploy traffic shifting: canary vs linear vs all-at-once

Accepted Answer

For Lambda/ECS, CodeDeploy shifts traffic to the new version by a strategy: canary moves a small percentage first, waits, then the rest; linear moves equal increments on a schedule; all-at-once switches everything immediately. Canary and linear limit blast radius and can auto-roll-back on CloudWatch alarms; all-at-once is fastest but riskiest.

Question 44

CodePipeline vs CodeBuild vs CodeDeploy

Accepted Answer

CodePipeline orchestrates the end-to-end CI/CD workflow as stages and actions. CodeBuild compiles, tests, and packages code per a buildspec.yml, producing artifacts. CodeDeploy delivers those artifacts to EC2, Lambda, or ECS using a deployment strategy. Pipeline is the conductor; CodeBuild is the build step; CodeDeploy is the release step.

Question 45

Elastic Beanstalk deployment policies

Accepted Answer

Beanstalk offers All at once (fastest, full downtime), Rolling (batches, reduced capacity), Rolling with additional batch (keeps full capacity by adding temporary instances), and Immutable / Blue-green (new instances or environment for safest rollback). The trade-off is speed and cost versus availability and rollback safety during a release.

Question 46

CloudWatch metrics vs logs vs alarms

Accepted Answer

Metrics are time-series numeric data (CPU, invocations, errors). Logs are text streams from applications and services that you can query and turn into metric filters. Alarms watch a metric against a threshold and trigger actions (SNS, Auto Scaling) when breached. Use metrics+alarms to detect/react, logs to investigate root cause.

Question 47

Custom CloudWatch metrics and high-resolution metrics

Accepted Answer

You publish custom metrics with PutMetricData for application-specific values not emitted by default. Standard metrics have one-minute granularity; high-resolution custom metrics support one-second granularity for fast detection. Use the EMF (embedded metric format) in logs to emit metrics efficiently from Lambda without extra API calls.

Question 48

AWS X-Ray distributed tracing

Accepted Answer

X-Ray traces a request as it flows across services, producing a service map and segments/subsegments that reveal latency, errors, and bottlenecks in distributed and serverless apps. You instrument with the X-Ray SDK or enable active tracing on Lambda/API Gateway; the daemon/agent forwards trace data. Use it to pinpoint which downstream call is slow or failing.

Question 49

DAX vs ElastiCache vs API Gateway caching

Accepted Answer

DAX is a DynamoDB-specific in-memory cache that accelerates eventually-consistent reads with no app changes beyond the client. ElastiCache (Redis/Memcached) is a general-purpose cache for any data source and supports custom caching patterns. API Gateway caching stores HTTP responses at the API layer. Pick the cache by what you are accelerating: DynamoDB, arbitrary data, or API responses.

Question 50

Lambda performance tuning: memory and the power/cost trade-off

Accepted Answer

Lambda allocates CPU proportionally to configured memory, so adding memory can make functions finish faster and sometimes cost the same or less despite a higher per-millisecond rate. Use AWS Lambda Power Tuning to find the optimal setting. Also reuse SDK clients and connections across invocations and right-size /tmp and timeout to balance speed and cost.

Free AWS Developer Associate Exam Flashcards

Filter by Topic

Jump to Card

About These AWS Developer Associate Flashcards

Topics Covered

Frequently Asked Questions

AWS Developer

Explore More AWS Certifications

AWS Cloud Practitioner

AWS Solutions Architect

AWS Certified AI Practitioner

AWS Data Engineer

AWS Certified Security – Specialty (SCS-C03)

AWS Database

More From This Family