AWS Developer Associate (DVA-C02) Practice Exam

Question 1 AWS Developer Associate (DVA-C02)

What is the maximum size of an SQS message?

Persists RAM contents to EBS root volume and stops instance. On start, RAM is restored. Works only for certain instance types and supported AMIs. Useful to skip cold starts. 256 KB. For larger payloads, store the data in S3 and send only the S3 reference in the message (use the Amazon SQS Extended Client for Java library pattern). As of 2020, S3 provides strong read-after-write consistency for all GET, PUT, LIST, and DELETE operations — there is no eventual consistency for object listings or updates. A time-ordered stream of item-level changes (insert, modify, remove) in a DynamoDB table. Retained for 24 hours. Used to trigger Lambda, replicate to other stores, or build materialized views.

Question 2 AWS Developer Associate (DVA-C02)

What is Amazon CloudWatch Container Insights?

Technology powering interface VPC endpoints. Provides private connectivity between VPCs, AWS services, and on-premises networks using elastic network interfaces with private IP addresses. Standard resolution metrics: 15 months with detailed data points (1 minute) available for the first 15 days, then aggregated to 5-minute and 1-hour. Detailed 1-second metrics expire after 3 hours. A CloudWatch feature that collects, aggregates, and summarizes metrics and logs from containerized applications and microservices running on ECS, EKS, Fargate, and Kubernetes. A free service in the AWS Console that helps you review workloads against the Well-Architected Framework, identify risks, track improvements, and benchmark against industry standards.

Question 3 AWS Developer Associate (DVA-C02)

What is the difference between AWS managed and customer managed CMKs?

DynamoDB Accelerator — a fully managed in-memory cache for DynamoDB that delivers up to 10x read performance. API-compatible with DynamoDB. Cluster must be in a single VPC and uses its own subnet group. AWS managed CMKs are created/managed by AWS services on your behalf (cannot be shared or rotated manually). Customer managed CMKs are created and managed by you, support key policies, rotation, aliases, and cross-account access. A stateful virtual firewall at the ENI/instance level that controls inbound and outbound traffic. Default SG allows all outbound and no inbound. SGs reference other SGs or CIDRs as sources; rules are stateful (return traffic allowed). EventBridge is the evolution of CloudWatch Events with additional features: schema registry, archive/replay, cross-account event buses, and third-party SaaS integrations. CloudWatch Events accounts continue to work via default EventBridge bus.

Question 4 AWS Developer Associate (DVA-C02)

How are DynamoDB read capacity units (RCU) billed?

Strongly consistent read of 4 KB/item = 1 RCU. Eventually consistent read of 4 KB/item = 0.5 RCU. Transactional read of 4 KB/item = 2 RCU. All rounded up to 4 KB. A durable block storage device that attaches to a single EC2 instance in one AZ. Snapshots are stored in S3 and are incremental. Use gp3 for general SSD, io1/io2 for high IOPS, st1 for throughput, sc1 for cold HDD. A time-ordered set of data points published to CloudWatch. Metrics are uniquely identified by namespace, metric name, and dimensions; standard resolution is 1-minute, detailed resolution is 1-second. An IAM user is a permanent identity with long-lived credentials. An IAM role is an identity with no long-lived credentials that is assumed temporarily by users, services, or external identities to obtain temporary STS tokens.

Question 5 AWS Developer Associate (DVA-C02)

What is a Lambda execution context?

A runtime environment that hosts the execution of a Lambda function, including the function code, runtime, environment variables, and any initialized state. Reused across invocations to amortize cold-start cost. HTTP API is cheaper (~70% lower), lower latency, and supports OIDC/OAuth2, JWT, and CORS but fewer features. REST API is feature-rich: API keys, usage plans, request validation, AWS WAF integration, request/response transformations. A time-ordered set of data points published to CloudWatch. Metrics are uniquely identified by namespace, metric name, and dimensions; standard resolution is 1-minute, detailed resolution is 1-second. User Pools are user directories (sign-up, sign-in, MFA, social IdP) that return JWT tokens. Identity Pools exchange those tokens (or other IdPs) for AWS STS temporary credentials to access AWS resources directly.

Question 6 AWS Developer Associate (DVA-C02)

What is an EBS snapshot?

A point-in-time backup of an EBS volume stored incrementally in S3. Snapshots are AZ-independent; you can copy them across regions/accounts. The first snapshot is full, subsequent ones are incremental. A logical access point for pub/sub messaging that fans out notifications to SQS queues, Lambda functions, HTTP(S) endpoints, email, SMS, or mobile push via platform endpoints. EventBridge is the evolution of CloudWatch Events with additional features: schema registry, archive/replay, cross-account event buses, and third-party SaaS integrations. CloudWatch Events accounts continue to work via default EventBridge bus. A mechanism to define throttling and quota limits for client API keys. Tracks usage per key and enforces rate limits and burst, returning 429 when exceeded.

Question 7 AWS Developer Associate (DVA-C02)

What is an EC2 placement group?

A serverless event bus service that ingests events from AWS services, SaaS apps, and custom sources, and routes them to targets (Lambda, SQS, SNS, Step Functions, etc.) using rules with event patterns or schedules. A script passed at launch that runs on first boot as root (Linux) or LocalSystem (Windows). Used to bootstrap, install software, register with services. Limited to 16 KB. A logical grouping for instances that influence placement: cluster (low-latency single AZ), spread (distinct hardware, up to 7 per AZ), partition (distinct racks, up to 7 partitions per AZ for Hadoop/Kafka). Cross-Region Replication (CRR) or Same-Region Replication (SRR) automatically copies new and (optionally) existing objects to a destination bucket. Requires versioning, IAM role with s3:Replicate permissions, and a destination in a different (or same) account.

Question 8 AWS Developer Associate (DVA-C02)

What is AWS CodeDeploy?

The SDK uses exponential backoff with jitter for retryable errors (e.g. throttling, 5xx). Default is 3 retries; tune `retries` config. Use exponential backoff with full jitter for custom retry logic. A deployment service that automates application deployments to EC2, ECS, Lambda, and on-premises. Supports in-place and blue/green deployments via appspec.yml. The duration (default 30s, max 12h) during which a message is hidden from other consumers after being received. If the consumer does not delete the message before the timeout expires, it becomes visible again. Automatically adjusts provisioned RCU/WCU within a min/max target based on actual consumption (target utilization, default 70%). Uses CloudWatch metrics and Application Auto Scaling.

Question 9 AWS Developer Associate (DVA-C02)

What is AWS Step Functions?

CloudTrail records API activity (who called what and when) for governance/audit. CloudWatch collects metrics, logs, and events for monitoring, alarming, and operational response. An operation that provides ACID guarantees across up to 100 items in one or more tables within a single AWS account and region. Uses TransactGetItems and TransactWriteItems APIs and consumes 2x the WCU/RCU. DynamoDB Accelerator — a fully managed in-memory cache for DynamoDB that delivers up to 10x read performance. API-compatible with DynamoDB. Cluster must be in a single VPC and uses its own subnet group. A serverless orchestrator that coordinates multiple AWS services into workflows using state machines defined in Amazon States Language (JSON). Supports standard (long-running, exactly-once) and express (high-volume, at-least-once) workflows.

Question 10 AWS Developer Associate (DVA-C02)

What is the maximum size of an IAM policy?

An Auto Scaling policy that adjusts capacity to keep a chosen CloudWatch metric (e.g. CPUUtilization at 50%) near a target value. Recommended over step/scheduled for most cases. 5,120 characters for managed policies attached to a user/group/role; service-specific quotas apply (e.g. inline user policy up to 2,048 chars, group 5,120, role 10,240). A service to ingest, monitor, store, and access log files from EC2, Lambda, VPC Flow Logs, CloudTrail, Route 53, and custom sources. Retention is configurable from 1 day to indefinitely. An instance configuration template that includes AMI, instance type, key pair, security groups, IAM instance profile, user data, tags, and market options. Required for Auto Scaling groups and Spot Fleets; can have multiple versions.

Question 11 AWS Developer Associate (DVA-C02)

What is a Lambda cold start?

A separate queue (redrive allows up to 100 source queues) that receives messages that failed processing after the redrive policy's maxReceiveCount is exceeded. Helps isolate and analyze failed messages. A URL generated using IAM credentials that grants temporary access to download or upload a specific S3 object. The URL inherits the permissions of the IAM principal who created it and can be customized with an expiration. The latency added when Lambda must initialize a new execution context (download code, start runtime, run init code). Mitigated by Provisioned Concurrency or by minimizing package size and init logic. A service that models and provisions AWS resources using declarative templates (JSON/YAML). StackSets extend CloudFormation to multiple accounts/regions. Supports drift detection, change sets, and nested stacks.

Question 12 AWS Developer Associate (DVA-C02)

What is the S3 strong consistency model?

gp3: baseline 3,000 IOPS and 125 MB/s, scalable to 16,000 IOPS and 1,000 MB/s at extra cost. io1/io2: provisioned IOPS, suitable for high-I/O databases; io2 Block Express supports up to 256,000 IOPS per volume and 4,000 MB/s with Nitro instances. Parameter Store is free (standard tier), stores plaintext or SecureString (KMS-encrypted) config and secrets, with versioning. Secrets Manager is paid, designed for secrets, includes automatic rotation and cross-region replication. A feature that keeps multiple variants of an object in the same bucket. Once enabled, it cannot be disabled — only suspended. Deletes become delete markers that can be reversed. As of 2020, S3 provides strong read-after-write consistency for all GET, PUT, LIST, and DELETE operations — there is no eventual consistency for object listings or updates.

Question 13 AWS Developer Associate (DVA-C02)

How long can temporary STS credentials last?

EventBridge is the evolution of CloudWatch Events with additional features: schema registry, archive/replay, cross-account event buses, and third-party SaaS integrations. CloudWatch Events accounts continue to work via default EventBridge bus. From 15 minutes up to a maximum of 12 hours (the absolute STS session duration hard cap); the role's MaxSessionDuration must be set within that range. A time-ordered stream of item-level changes (insert, modify, remove) in a DynamoDB table. Retained for 24 hours. Used to trigger Lambda, replicate to other stores, or build materialized views. Technology powering interface VPC endpoints. Provides private connectivity between VPCs, AWS services, and on-premises networks using elastic network interfaces with private IP addresses.

Question 14 AWS Developer Associate (DVA-C02)

What is the recommended way to give a Lambda function access to AWS services?

A time-ordered set of data points published to CloudWatch. Metrics are uniquely identified by namespace, metric name, and dimensions; standard resolution is 1-minute, detailed resolution is 1-second. Attach an IAM execution role to the Lambda function. Lambda automatically populates environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN. A service to add authentication, authorization, and user management to web/mobile apps. Two main components: User Pools (sign-in, JWT tokens) and Identity Pools (federation, AWS temporary credentials for direct AWS access). An upload split into parts (5 MB to 5 GB each, up to 10,000 parts) to improve throughput, allow parallel uploading, and enable resumable uploads of objects up to 5 TB. Recommended for files larger than 100 MB.

Question 15 AWS Developer Associate (DVA-C02)

What is an SQS standard queue?

EventBridge is the evolution of CloudWatch Events with additional features: schema registry, archive/replay, cross-account event buses, and third-party SaaS integrations. CloudWatch Events accounts continue to work via default EventBridge bus. A queue offering best-effore ordering, at-least-once delivery, and unlimited throughput. Messages may be delivered more than once and out of order. Data about the instance accessible at http://169.254.169.254/latest/meta-data/. Includes instance ID, IAM role credentials (under /iam/), region, AZ. IMDSv2 requires session-token PUT to mitigate SSRF attacks. A deployment service that automates application deployments to EC2, ECS, Lambda, and on-premises. Supports in-place and blue/green deployments via appspec.yml.

Question 16 AWS Developer Associate (DVA-C02)

How do you grant an EC2 instance permission to call AWS APIs without storing keys?

A free service in the AWS Console that helps you review workloads against the Well-Architected Framework, identify risks, track improvements, and benchmark against industry standards. A script passed at launch that runs on first boot as root (Linux) or LocalSystem (Windows). Used to bootstrap, install software, register with services. Limited to 16 KB. The duration (default 30s, max 12h) during which a message is hidden from other consumers after being received. If the consumer does not delete the message before the timeout expires, it becomes visible again. Attach an IAM instance profile (a container for an IAM role) to the EC2 instance. The SDK/CLI automatically retrieves credentials from IMDS on the instance.

Question 17 AWS Developer Associate (DVA-C02)

What is the difference between Secrets Manager and SSM Parameter Store?

5,120 characters for managed policies attached to a user/group/role; service-specific quotas apply (e.g. inline user policy up to 2,048 chars, group 5,120, role 10,240). Standard resolution metrics: 15 months with detailed data points (1 minute) available for the first 15 days, then aggregated to 5-minute and 1-hour. Detailed 1-second metrics expire after 3 hours. Parameter Store is free (standard tier), stores plaintext or SecureString (KMS-encrypted) config and secrets, with versioning. Secrets Manager is paid, designed for secrets, includes automatic rotation and cross-region replication. Key Management Service — a managed service to create and control encryption keys (CMKs). Supports symmetric and asymmetric keys, integrates with most AWS services. Charges per key + per API call.

Question 18 AWS Developer Associate (DVA-C02)

What is DynamoDB on-demand capacity?

Automatically adjusts provisioned RCU/WCU within a min/max target based on actual consumption (target utilization, default 70%). Uses CloudWatch metrics and Application Auto Scaling. A free service in the AWS Console that helps you review workloads against the Well-Architected Framework, identify risks, track improvements, and benchmark against industry standards. A managed service to create, publish, maintain, monitor, and secure REST, HTTP, and WebSocket APIs at any scale. Handles routing, auth, throttling, request/response transformation, and integrates with Lambda and other backends. A pricing mode that charges per request (no provisioned capacity). Useful for unpredictable workloads. Pricing: $1.25 per million read request units, $1.25 per million write request units (varies by region).

Question 19 AWS Developer Associate (DVA-C02)

What is a sticky session?

An IAM user is a permanent identity with long-lived credentials. An IAM role is an identity with no long-lived credentials that is assumed temporarily by users, services, or external identities to obtain temporary STS tokens. ALB/NLB feature that binds a user session to a specific target using a cookie. Useful for stateful apps. Cookie types: application-based (custom), duration-based, or load-balancer-generated. SNS is a pub/sub fan-out push service with no message retention. SQS is a message queue with message retention (up to 14 days), consumers poll for messages, and supports standard and FIFO queues. A service to add authentication, authorization, and user management to web/mobile apps. Two main components: User Pools (sign-in, JWT tokens) and Identity Pools (federation, AWS temporary credentials for direct AWS access).

Question 20 AWS Developer Associate (DVA-C02)

What is a Network Load Balancer (NLB)?

Persists RAM contents to EBS root volume and stops instance. On start, RAM is restored. Works only for certain instance types and supported AMIs. Useful to skip cold starts. gp3: baseline 3,000 IOPS and 125 MB/s, scalable to 16,000 IOPS and 1,000 MB/s at extra cost. io1/io2: provisioned IOPS, suitable for high-I/O databases; io2 Block Express supports up to 256,000 IOPS per volume and 4,000 MB/s with Nitro instances. A Layer 4 load balancer that routes TCP/UDP/TLS traffic with ultra-low latency and high throughput. Preserves source IP, supports static IPs, and integrates with PrivateLink service providers. A multi-region, multi-active replicated table that supports low-latency global reads and writes. Replication is synchronous using a write-through architecture; conflict resolution is last-writer-wins.

Question 21 AWS Developer Associate (DVA-C02)

What is AWS CloudFormation?

A private connection from a VPC to an AWS service without traversing the public internet. Interface endpoint (PrivateLink) uses ENIs with private IPs. Gateway endpoint is free for S3 and DynamoDB — uses a route table entry. A service that models and provisions AWS resources using declarative templates (JSON/YAML). StackSets extend CloudFormation to multiple accounts/regions. Supports drift detection, change sets, and nested stacks. Elastic Kubernetes Service — managed Kubernetes. AWS manages the control plane (etcd, scheduler, API server) across multiple AZs; you provide worker nodes (EC2) or use Fargate. A serverless orchestrator that coordinates multiple AWS services into workflows using state machines defined in Amazon States Language (JSON). Supports standard (long-running, exactly-once) and express (high-volume, at-least-once) workflows.

Question 22 AWS Developer Associate (DVA-C02)

What is an IAM role vs an IAM user?

A fully managed NoSQL key-value and document database offering single-digit millisecond performance at any scale, with built-in security, backup, and multi-region replication. Rate limits that protect backends and your account. Default account limit is 10,000 RPS steady-state with 5,000 burst. Per-method/per-stage limits can be set lower; exceeding returns HTTP 429. An IAM user is a permanent identity with long-lived credentials. An IAM role is an identity with no long-lived credentials that is assumed temporarily by users, services, or external identities to obtain temporary STS tokens. A feature that enforces WORM (write-once-read-many) on objects via retention periods or legal holds. Must be enabled at bucket creation, and versioning must be enabled. Complies with SEC 17a-4.

Question 23 AWS Developer Associate (DVA-C02)

What is AWS AppSync?

STANDARD, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, GLACIER_INSTANT_RETRIEVAL, GLACIER_FLEXIBLE_RETRIEVAL (formerly Glacier), GLACIER_DEEP_ARCHIVE, and EXPRESS_ONEZONE (single-AZ, lowest latency). A feature that automatically deletes expired items at no cost. Specify a numeric attribute containing epoch time; expired items are removed within 48 hours of expiration. An object that watches a single metric over a time period and performs one or more actions (e.g. notify SNS, trigger Auto Scaling, stop/terminate EC2) when the threshold is crossed for a configured number of evaluation periods. A managed GraphQL service that securely connects to data sources (DynamoDB, RDS, Lambda, HTTP endpoints). Supports real-time subscriptions, offline caching, fine-grained auth via OIDC/Cognito/API key/IAM.

Question 24 AWS Developer Associate (DVA-C02)

What is a blue/green deployment?

Serverless compute engine for containers that works with ECS and EKS. You define task/pod requirements; AWS provisions and scales the underlying infrastructure. Pay per vCPU and GB-hour. A strategy where two identical environments (blue = current, green = new) run simultaneously. Traffic is shifted from blue to green via DNS/ALB/Route 53 weighted records. Allows instant rollback. A managed service to create, publish, maintain, monitor, and secure REST, HTTP, and WebSocket APIs at any scale. Handles routing, auth, throttling, request/response transformation, and integrates with Lambda and other backends. A distributed tracing service that helps developers analyze and debug distributed applications. Captures traces, segments, errors, and provides a service map. SDKs available for Java, Node.js, Python, Go, .NET, Ruby.

Question 25 AWS Developer Associate (DVA-C02)

What is the difference between gp3 and io1/io2 EBS volumes?

A logically isolated virtual network in AWS where you launch AWS resources. You control IP range (CIDR), subnets, route tables, gateways, and security. gp3: baseline 3,000 IOPS and 125 MB/s, scalable to 16,000 IOPS and 1,000 MB/s at extra cost. io1/io2: provisioned IOPS, suitable for high-I/O databases; io2 Block Express supports up to 256,000 IOPS per volume and 4,000 MB/s with Nitro instances. 5,120 characters for managed policies attached to a user/group/role; service-specific quotas apply (e.g. inline user policy up to 2,048 chars, group 5,120, role 10,240). A logical access point for pub/sub messaging that fans out notifications to SQS queues, Lambda functions, HTTP(S) endpoints, email, SMS, or mobile push via platform endpoints.

Question 26 AWS Developer Associate (DVA-C02)

What is the AWS Well-Architected Framework?

Five pillars: Operational Excellence, Security, Reliability, Performance Efficiency, Cost Optimization. Plus Sustainability. Used to evaluate architectures and identify improvements. An operation that provides ACID guarantees across up to 100 items in one or more tables within a single AWS account and region. Uses TransactGetItems and TransactWriteItems APIs and consumes 2x the WCU/RCU. A private connection from a VPC to an AWS service without traversing the public internet. Interface endpoint (PrivateLink) uses ENIs with private IPs. Gateway endpoint is free for S3 and DynamoDB — uses a route table entry. A serverless event bus service that ingests events from AWS services, SaaS apps, and custom sources, and routes them to targets (Lambda, SQS, SNS, Step Functions, etc.) using rules with event patterns or schedules.

Question 27 AWS Developer Associate (DVA-C02)

What is AWS SAM (Serverless Application Model)?

An open-source framework (CloudFormation extension) used to define serverless applications (Lambda, API Gateway, DynamoDB, SQS) in simplified YAML/JSON syntax. Build with `sam build`, deploy with `sam deploy`. An object that watches a single metric over a time period and performs one or more actions (e.g. notify SNS, trigger Auto Scaling, stop/terminate EC2) when the threshold is crossed for a configured number of evaluation periods. An index with a partition key and optional sort key, different from the base table's. Has its own provisioned or on-demand throughput. Can be added/modified after table creation. Size is not constrained to 10 GB per partition. A service to ingest, monitor, store, and access log files from EC2, Lambda, VPC Flow Logs, CloudTrail, Route 53, and custom sources. Retention is configurable from 1 day to indefinitely.

Question 28 AWS Developer Associate (DVA-C02)

What does AWS STS provide?

An index with a partition key and optional sort key, different from the base table's. Has its own provisioned or on-demand throughput. Can be added/modified after table creation. Size is not constrained to 10 GB per partition. Elastic Kubernetes Service — managed Kubernetes. AWS manages the control plane (etcd, scheduler, API server) across multiple AZs; you provide worker nodes (EC2) or use Fargate. Security Token Service — issues short-lived temporary credentials (access key, secret key, session token) for federated identities, assumed roles, or cross-account access. A distributed tracing service that helps developers analyze and debug distributed applications. Captures traces, segments, errors, and provides a service map. SDKs available for Java, Node.js, Python, Go, .NET, Ruby.

Question 29 AWS Developer Associate (DVA-C02)

What is the visibility timeout in SQS?

A feature that enforces WORM (write-once-read-many) on objects via retention periods or legal holds. Must be enabled at bucket creation, and versioning must be enabled. Complies with SEC 17a-4. A managed AWS service in a public subnet that allows instances in private subnets to initiate outbound internet traffic (e.g. for updates) while preventing unsolicited inbound connections. Charged per hour + per GB processed. The duration (default 30s, max 12h) during which a message is hidden from other consumers after being received. If the consumer does not delete the message before the timeout expires, it becomes visible again. HTTP API is cheaper (~70% lower), lower latency, and supports OIDC/OAuth2, JWT, and CORS but fewer features. REST API is feature-rich: API keys, usage plans, request validation, AWS WAF integration, request/response transformations.

Question 30 AWS Developer Associate (DVA-C02)

What is the maximum Lambda deployment package size?

An instance configuration template that includes AMI, instance type, key pair, security groups, IAM instance profile, user data, tags, and market options. Required for Auto Scaling groups and Spot Fleets; can have multiple versions. 50 MB zipped for direct upload, 250 MB unzipped (direct), or up to 4 GB when uploaded from /tmp via EFS (Lambda mounts EFS for large files). Attach an IAM execution role to the Lambda function. Lambda automatically populates environment variables AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, and AWS_SESSION_TOKEN. A Layer 4 load balancer that routes TCP/UDP/TLS traffic with ultra-low latency and high throughput. Preserves source IP, supports static IPs, and integrates with PrivateLink service providers.

Question 31 AWS Developer Associate (DVA-C02)

What is an Amazon VPC?

A managed service to create, publish, maintain, monitor, and secure REST, HTTP, and WebSocket APIs at any scale. Handles routing, auth, throttling, request/response transformation, and integrates with Lambda and other backends. Rate limits that protect backends and your account. Default account limit is 10,000 RPS steady-state with 5,000 burst. Per-method/per-stage limits can be set lower; exceeding returns HTTP 429. Elastic Kubernetes Service — managed Kubernetes. AWS manages the control plane (etcd, scheduler, API server) across multiple AZs; you provide worker nodes (EC2) or use Fargate. A logically isolated virtual network in AWS where you launch AWS resources. You control IP range (CIDR), subnets, route tables, gateways, and security.

Question 32 AWS Developer Associate (DVA-C02)

What is the difference between API Gateway REST API and HTTP API?

An instance configuration template that includes AMI, instance type, key pair, security groups, IAM instance profile, user data, tags, and market options. Required for Auto Scaling groups and Spot Fleets; can have multiple versions. HTTP API is cheaper (~70% lower), lower latency, and supports OIDC/OAuth2, JWT, and CORS but fewer features. REST API is feature-rich: API keys, usage plans, request validation, AWS WAF integration, request/response transformations. The duration (default 30s, max 12h) during which a message is hidden from other consumers after being received. If the consumer does not delete the message before the timeout expires, it becomes visible again. gp3: baseline 3,000 IOPS and 125 MB/s, scalable to 16,000 IOPS and 1,000 MB/s at extra cost. io1/io2: provisioned IOPS, suitable for high-I/O databases; io2 Block Express supports up to 256,000 IOPS per volume and 4,000 MB/s with Nitro instances.

Question 33 AWS Developer Associate (DVA-C02)

What is a CloudWatch metric?

A storage unit for a group of items. Items are placed in partitions based on the hash of the partition key. A single partition can hold up to 10 GB and serve up to 3,000 RCUs and 1,000 WCUs. A time-ordered set of data points published to CloudWatch. Metrics are uniquely identified by namespace, metric name, and dimensions; standard resolution is 1-minute, detailed resolution is 1-second. An index with a partition key and optional sort key, different from the base table's. Has its own provisioned or on-demand throughput. Can be added/modified after table creation. Size is not constrained to 10 GB per partition. A durable block storage device that attaches to a single EC2 instance in one AZ. Snapshots are stored in S3 and are incremental. Use gp3 for general SSD, io1/io2 for high IOPS, st1 for throughput, sc1 for cold HDD.

Question 34 AWS Developer Associate (DVA-C02)

What is S3 versioning?

128 MB to 10,240 MB, in 1-MB increments. CPU and network bandwidth scale linearly with memory allocation. A feature that keeps multiple variants of an object in the same bucket. Once enabled, it cannot be disabled — only suspended. Deletes become delete markers that can be reversed. A low-cost cold storage service for archives. Retrieval options: Expedited (1–5 min), Standard (3–5 h), Bulk (5–12 h). Glacier Flexible Retrieval is the renamed Glacier; Glacier Deep Archive is the cheapest (12–48 h). Partition key (hash) only — items are distributed by partition. Composite primary key (partition key + sort key) — items sharing a partition are ordered by the sort key for range queries.

Question 35 AWS Developer Associate (DVA-C02)

What is the default Lambda timeout?

CloudTrail records API activity (who called what and when) for governance/audit. CloudWatch collects metrics, logs, and events for monitoring, alarming, and operational response. 900 seconds (15 minutes). Maximum timeout is also 15 minutes; use Step Functions for longer workflows. One standard write of up to 1 KB = 1 WCU. One transactional write of up to 1 KB = 2 WCU. Rounded up to 1 KB. A feature that enforces WORM (write-once-read-many) on objects via retention periods or legal holds. Must be enabled at bucket creation, and versioning must be enabled. Complies with SEC 17a-4.

Question 36 AWS Developer Associate (DVA-C02)

What is Amazon S3 Glacier Instant Retrieval?

Cloud Development Kit — a software development framework (TypeScript, Python, Java, Go, .NET) to define cloud resources in code and synthesize them into CloudFormation templates. Storage class for archive data needing millisecond retrieval, with a minimum 90-day storage charge and retrieval fees. Cheaper than S3 Standard-IA for rarely accessed data needing instant access. A URL generated using IAM credentials that grants temporary access to download or upload a specific S3 object. The URL inherits the permissions of the IAM principal who created it and can be customized with an expiration. EventBridge is the evolution of CloudWatch Events with additional features: schema registry, archive/replay, cross-account event buses, and third-party SaaS integrations. CloudWatch Events accounts continue to work via default EventBridge bus.

Question 37 AWS Developer Associate (DVA-C02)

What is a DynamoDB partition?

An instance configuration template that includes AMI, instance type, key pair, security groups, IAM instance profile, user data, tags, and market options. Required for Auto Scaling groups and Spot Fleets; can have multiple versions. Security Token Service — issues short-lived temporary credentials (access key, secret key, session token) for federated identities, assumed roles, or cross-account access. A storage unit for a group of items. Items are placed in partitions based on the hash of the partition key. A single partition can hold up to 10 GB and serve up to 3,000 RCUs and 1,000 WCUs. Web Application Firewall — protects web applications from common exploits (SQLi, XSS, bad bots, IP rate limiting) by inspecting HTTP/S requests. Can be attached to CloudFront, ALB, API Gateway, AppSync, Cognito User Pool.

Question 38 AWS Developer Associate (DVA-C02)

What is an EBS volume?

A durable block storage device that attaches to a single EC2 instance in one AZ. Snapshots are stored in S3 and are incremental. Use gp3 for general SSD, io1/io2 for high IOPS, st1 for throughput, sc1 for cold HDD. 50 MB zipped for direct upload, 250 MB unzipped (direct), or up to 4 GB when uploaded from /tmp via EFS (Lambda mounts EFS for large files). Persists RAM contents to EBS root volume and stops instance. On start, RAM is restored. Works only for certain instance types and supported AMIs. Useful to skip cold starts. A mechanism to define throttling and quota limits for client API keys. Tracks usage per key and enforces rate limits and burst, returning 429 when exceeded.

Question 39 AWS Developer Associate (DVA-C02)

What is DynamoDB DAX?

DynamoDB Accelerator — a fully managed in-memory cache for DynamoDB that delivers up to 10x read performance. API-compatible with DynamoDB. Cluster must be in a single VPC and uses its own subnet group. Instance Metadata Service Version 2 — requires a PUT request with a custom header to get a session token before any metadata request. Protects against SSRF and reduces risk of credential theft. AWS CloudTrail — records every API call made in the account, including identity, time, source IP, and request/response details, stored in S3 and optionally CloudWatch Logs. Persists RAM contents to EBS root volume and stops instance. On start, RAM is restored. Works only for certain instance types and supported AMIs. Useful to skip cold starts.

Question 40 AWS Developer Associate (DVA-C02)

What is an S3 bucket policy vs IAM policy?

A CloudWatch feature that collects, aggregates, and summarizes metrics and logs from containerized applications and microservices running on ECS, EKS, Fargate, and Kubernetes. A point-in-time backup of an EBS volume stored incrementally in S3. Snapshots are AZ-independent; you can copy them across regions/accounts. The first snapshot is full, subsequent ones are incremental. An S3 bucket policy is a resource-based policy attached to a specific bucket using JSON. An IAM policy is identity-based and can grant access to multiple S3 buckets. Bucket policies are required for cross-account access and for public/anonymous principals. A low-cost cold storage service for archives. Retrieval options: Expedited (1–5 min), Standard (3–5 h), Bulk (5–12 h). Glacier Flexible Retrieval is the renamed Glacier; Glacier Deep Archive is the cheapest (12–48 h).

Question 41 AWS Developer Associate (DVA-C02)

What is AWS Secrets Manager?

A service to securely store, rotate, manage, and retrieve database credentials, API keys, and other secrets. Supports automatic rotation via Lambda. Integrates with RDS, Redshift, DocumentDB. An operation that provides ACID guarantees across up to 100 items in one or more tables within a single AWS account and region. Uses TransactGetItems and TransactWriteItems APIs and consumes 2x the WCU/RCU. Elastic Container Service — a fully managed container orchestration service supporting Docker containers. Two launch types: EC2 (you manage instances) and Fargate (serverless, AWS manages infra). 50 MB zipped for direct upload, 250 MB unzipped (direct), or up to 4 GB when uploaded from /tmp via EFS (Lambda mounts EFS for large files).

Question 42 AWS Developer Associate (DVA-C02)

What is Amazon Cognito?

14 days. Default retention is 4 days. Messages older than the retention are automatically deleted. A service to add authentication, authorization, and user management to web/mobile apps. Two main components: User Pools (sign-in, JWT tokens) and Identity Pools (federation, AWS temporary credentials for direct AWS access). A managed GraphQL service that securely connects to data sources (DynamoDB, RDS, Lambda, HTTP endpoints). Supports real-time subscriptions, offline caching, fine-grained auth via OIDC/Cognito/API key/IAM. Standard resolution metrics: 15 months with detailed data points (1 minute) available for the first 15 days, then aggregated to 5-minute and 1-hour. Detailed 1-second metrics expire after 3 hours.

Question 43 AWS Developer Associate (DVA-C02)

What is AWS Shield?

Parameter Store is free (standard tier), stores plaintext or SecureString (KMS-encrypted) config and secrets, with versioning. Secrets Manager is paid, designed for secrets, includes automatic rotation and cross-region replication. A managed DDoS protection service. Standard is free for all AWS customers (defends against common network/transport layer attacks). Advanced is paid and adds detection, mitigation, cost protection, and 24/7 DRT. A feature that captures information about IP traffic going to/from network interfaces in a VPC. Stored in CloudWatch Logs or S3. Used for troubleshooting connectivity, security analysis, and detecting anomalous traffic. A serverless event bus service that ingests events from AWS services, SaaS apps, and custom sources, and routes them to targets (Lambda, SQS, SNS, Step Functions, etc.) using rules with event patterns or schedules.

Question 44 AWS Developer Associate (DVA-C02)

What is a target group?

Elastic Kubernetes Service — managed Kubernetes. AWS manages the control plane (etcd, scheduler, API server) across multiple AZs; you provide worker nodes (EC2) or use Fargate. Automatically adjusts provisioned RCU/WCU within a min/max target based on actual consumption (target utilization, default 70%). Uses CloudWatch metrics and Application Auto Scaling. A set of registered targets (EC2 instances, IPs, Lambda, containers) that an ALB or NLB routes requests to. Each target group has health checks that determine routing. 128 MB to 10,240 MB, in 1-MB increments. CPU and network bandwidth scale linearly with memory allocation.

Question 45 AWS Developer Associate (DVA-C02)

What is the Lambda concurrency limit?

Cloud Development Kit — a software development framework (TypeScript, Python, Java, Go, .NET) to define cloud resources in code and synthesize them into CloudFormation templates. A Layer 7 load balancer that routes HTTP/HTTPS/gRPC traffic based on path, host, query string, or header. Supports WebSockets, sticky sessions, WAF, OIDC auth, and target groups of EC2, IP, Lambda, ECS. Data about the instance accessible at http://169.254.169.254/latest/meta-data/. Includes instance ID, IAM role credentials (under /iam/), region, AZ. IMDSv2 requires session-token PUT to mitigate SSRF attacks. Default account concurrency limit is 1,000. Each function can be reserved (reserved concurrency) or limited, and provisioned concurrency provides warm execution environments on demand.

Question 46 AWS Developer Associate (DVA-C02)

What is a public vs private subnet?

900 seconds (15 minutes). Maximum timeout is also 15 minutes; use Step Functions for longer workflows. Public subnet has a route to an Internet Gateway (IGW); instances get public IPs and are reachable from the internet. Private subnet has no IGW route; instances need NAT Gateway (or NAT instance) for outbound internet. A distributed tracing service that helps developers analyze and debug distributed applications. Captures traces, segments, errors, and provides a service map. SDKs available for Java, Node.js, Python, Go, .NET, Ruby. 128 MB to 10,240 MB, in 1-MB increments. CPU and network bandwidth scale linearly with memory allocation.

Question 47 AWS Developer Associate (DVA-C02)

What is DynamoDB?

Cross-Region Replication (CRR) or Same-Region Replication (SRR) automatically copies new and (optionally) existing objects to a destination bucket. Requires versioning, IAM role with s3:Replicate permissions, and a destination in a different (or same) account. A continuous delivery service that models release pipelines. Each stage contains actions (e.g. source, build, test, deploy) and can have manual approval steps. Triggers Lambda on state changes. A fully managed NoSQL key-value and document database offering single-digit millisecond performance at any scale, with built-in security, backup, and multi-region replication. HTTP API is cheaper (~70% lower), lower latency, and supports OIDC/OAuth2, JWT, and CORS but fewer features. REST API is feature-rich: API keys, usage plans, request validation, AWS WAF integration, request/response transformations.

Question 48 AWS Developer Associate (DVA-C02)

What is a DynamoDB GSI (Global Secondary Index)?

SNS is a pub/sub fan-out push service with no message retention. SQS is a message queue with message retention (up to 14 days), consumers poll for messages, and supports standard and FIFO queues. Cross-Region Replication (CRR) or Same-Region Replication (SRR) automatically copies new and (optionally) existing objects to a destination bucket. Requires versioning, IAM role with s3:Replicate permissions, and a destination in a different (or same) account. Serverless compute engine for containers that works with ECS and EKS. You define task/pod requirements; AWS provisions and scales the underlying infrastructure. Pay per vCPU and GB-hour. An index with a partition key and optional sort key, different from the base table's. Has its own provisioned or on-demand throughput. Can be added/modified after table creation. Size is not constrained to 10 GB per partition.

Question 49 AWS Developer Associate (DVA-C02)

What is a DynamoDB transaction?

A separate queue (redrive allows up to 100 source queues) that receives messages that failed processing after the redrive policy's maxReceiveCount is exceeded. Helps isolate and analyze failed messages. Encrypting data with a data key, then encrypting that data key with a KMS CMK. The data key is stored with the encrypted data. Reduces KMS API calls and lets you encrypt large payloads. A logical grouping for instances that influence placement: cluster (low-latency single AZ), spread (distinct hardware, up to 7 per AZ), partition (distinct racks, up to 7 partitions per AZ for Hadoop/Kafka). An operation that provides ACID guarantees across up to 100 items in one or more tables within a single AWS account and region. Uses TransactGetItems and TransactWriteItems APIs and consumes 2x the WCU/RCU.

Question 50 AWS Developer Associate (DVA-C02)

What is VPC Flow Logs?

A serverless event bus service that ingests events from AWS services, SaaS apps, and custom sources, and routes them to targets (Lambda, SQS, SNS, Step Functions, etc.) using rules with event patterns or schedules. A feature that enforces WORM (write-once-read-many) on objects via retention periods or legal holds. Must be enabled at bucket creation, and versioning must be enabled. Complies with SEC 17a-4. Serverless compute engine for containers that works with ECS and EKS. You define task/pod requirements; AWS provisions and scales the underlying infrastructure. Pay per vCPU and GB-hour. A feature that captures information about IP traffic going to/from network interfaces in a VPC. Stored in CloudWatch Logs or S3. Used for troubleshooting connectivity, security analysis, and detecting anomalous traffic.