Free DVA-C03 practice questions: 20 with answers
Twenty questions across the four DVA-C03 domains, spread in proportion to the weights AWS announced (30/26/22/22): six on development with AWS services, five on security, five on testing and deployment and four on troubleshooting and optimization. These are original scenario questions, not questions from the real exam. Find the constraint in each scenario, such as ordering, cost, credentials or rollback, before you read the options.
Development with AWS Services
Question 1. A Lambda function reads records from a DynamoDB stream. One malformed record always makes the function fail, so the shard is blocked and newer records are not processed. What should you configure on the event source mapping?
- A. A longer function timeout
- B. A larger batch size
- C. Bisect batch on error, a maximum retry count and an on-failure destination
- D. A second DynamoDB table that receives a copy of the stream
Show answer
Answer: C
For stream sources you can limit retries with a maximum retry attempts value, split failing batches with bisect on function error, and send the details of discarded records to an on-failure destination such as an SQS queue. That isolates the bad record and lets the shard move on. A longer timeout does not fix a record that always fails, a larger batch makes the blocking worse, and a stream cannot be redirected to a second table to skip a record.
Want more questions like this? Full DVA-C03 practice tests →
Question 2. Two users can open and save the same profile item in DynamoDB at the same time, and the last save silently overwrites the first. Neither user should lose changes without being told. What is the best approach?
- A. Read with eventual consistency before every save
- B. Add a version attribute and save with a condition that the version has not changed
- C. Increase the provisioned write capacity of the table
- D. Create a global secondary index on the profile ID
Show answer
Answer: B
Optimistic locking keeps a version attribute on the item and writes with a condition expression that the version is still the one that was read. A concurrent change makes the write fail with a conditional check error, and the application can reload and retry. Eventually consistent reads make staleness worse, a larger write capacity does not order writes, and a global secondary index does not prevent overwrites.
Want more questions like this? Full DVA-C03 practice tests →
Question 3. A worker polls an SQS queue in a loop with ReceiveMessage. The queue is empty most of the time, and the team pays for a large number of requests that return nothing. How can they reduce the number of empty responses with the least code change?
- A. Enable long polling with a wait time of up to 20 seconds
- B. Lower the visibility timeout to one second
- C. Lower the message retention period
- D. Replace the queue with a FIFO queue
Show answer
Answer: A
Long polling makes ReceiveMessage wait up to 20 seconds for a message to arrive before returning, which cuts empty responses and cost, and it can be set with the wait time seconds parameter or on the queue. Shorter visibility timeouts and a shorter retention period do not change how often empty receives happen, and a FIFO queue does not remove polling.
Want more questions like this? Full DVA-C03 practice tests →
Question 4. An application using an AWS SDK sometimes receives throttling errors when many instances call the same API at once, and all retries happen at the same moment. What should the developer do?
- A. Retry immediately in a tight loop until the call succeeds
- B. Catch the error and ignore it
- C. Wait a fixed five seconds and retry from every instance
- D. Retry with exponential backoff and random jitter
Show answer
Answer: D
Retries with exponential backoff and jitter spread out the retry attempts so they do not collide again, and the AWS SDKs support configuring this. Retrying immediately in a tight loop makes throttling worse, ignoring errors loses work, and a single fixed delay makes all clients retry together again.
Want more questions like this? Full DVA-C03 practice tests →
Question 5. A table holds user sessions that are useless after their expiry time. The team wants them removed automatically without spending write capacity on the deletions. What should they use?
- A. A scheduled Lambda function that scans the table and deletes old items
- B. A global secondary index on the expiry attribute
- C. Enable Time to Live on an epoch-time expiry attribute
- D. Switch the table to the Standard-IA table class
Show answer
Answer: C
With DynamoDB Time to Live you store an expiry timestamp in a number attribute, and DynamoDB deletes expired items in the background at no extra write cost. A scheduled Lambda scan and delete consumes read and write capacity, and a global secondary index only helps find items. Changing the table class affects storage pricing, not deletion.
Want more questions like this? Full DVA-C03 practice tests →
Question 6. An Amazon ECS service on Fargate fails to start tasks with an error saying the image cannot be pulled from a private Amazon ECR repository. The application code, once running, uses its own task role successfully. Which role is missing a permission?
- A. The task role
- B. The task execution role
- C. The IAM user of the developer who deployed the service
- D. The instance profile of the Fargate host
Show answer
Answer: B
Pulling the image and sending logs are done by the ECS agent before your code runs, so they use the task execution role, which needs the ECR pull permissions, as in the AmazonECSTaskExecutionRolePolicy managed policy. The task role is what your application code uses at runtime, a developer’s IAM user is not involved when ECS starts the task, and Fargate has no instance profile you manage because there are no EC2 instances for you to configure.
Want more questions like this? Full DVA-C03 practice tests →
Security
Question 7. A single-page app signs users in with an Amazon Cognito user pool. The backend is an API Gateway REST API, and only signed-in users may call it, with no custom authorizer code. What should you configure?
- A. A Cognito user pool authorizer on the API methods
- B. IAM authorization with a user per customer
- C. An API key distributed in the app
- D. A resource policy allowing all source IP addresses
Show answer
Answer: A
A Cognito user pool authorizer on the API validates the ID or access token issued by the user pool and rejects requests without a valid token, with no code to maintain. IAM authorization expects SigV4-signed requests, an API key is for usage plans rather than user identity, and a resource policy that allows all source IPs does not authenticate anyone.
Want more questions like this? Full DVA-C03 practice tests →
Question 8. A chat feature sends user text to a foundation model on Amazon Bedrock. The company must block a list of forbidden topics and mask card numbers and email addresses in both prompts and responses, without changing the model. What should the developer use?
- A. A longer system prompt asking the model to avoid those topics
- B. AWS CloudTrail data events on the model
- C. A larger foundation model with more training data
- D. Amazon Bedrock Guardrails with denied topics and sensitive information filters
Show answer
Answer: D
Amazon Bedrock Guardrails can deny defined topics and filter sensitive information such as payment card numbers and email addresses in inputs and outputs, and can be applied when invoking the model. Prompt wording alone is not an enforced control, CloudTrail records API calls but does not filter content, and a larger model does not guarantee that topics or data are blocked.
Want more questions like this? Full DVA-C03 practice tests →
Question 9. A Lambda function must call one specific Amazon Bedrock foundation model and nothing else in Bedrock. Which IAM statement for the function's execution role follows least privilege?
- A. Allow bedrock:* on all resources
- B. Allow bedrock:InvokeModel on the ARN of that foundation model
- C. Attach the AdministratorAccess managed policy
- D. Allow bedrock:ListFoundationModels on all resources
Show answer
Answer: B
Allowing bedrock:InvokeModel on the ARN of that single foundation model limits both the action and the resource (if the model is called through an inference profile, that profile’s ARN is needed as well). A wildcard on all Bedrock actions and resources grants far more than needed, the AWS managed administrator policy is broader still, and allowing only read-style list actions would not let the function invoke the model.
Want more questions like this? Full DVA-C03 practice tests →
Question 10. A Lambda function in account A must write to an S3 bucket in account B. Account B does not want to create an IAM user for it or share long-lived keys. What should account B set up?
- A. An IAM user with an access key stored in a Lambda environment variable
- B. A public bucket with write access for everyone
- C. A role that trusts account A’s function role, which the function assumes through STS
- D. A console password for the function
Show answer
Answer: C
An IAM role in account B with a trust policy naming account A’s execution role, plus a permissions policy for the bucket, lets the function call sts:AssumeRole and receive temporary credentials. Access keys are long-lived, a public bucket removes access control, and a password for the function does not exist as a concept in IAM.
Want more questions like this? Full DVA-C03 practice tests →
Question 11. Security requires that every object uploaded to a bucket is encrypted with SSE-KMS and that uploads without it are rejected, not silently encrypted another way. What should the bucket policy do?
- A. Deny s3:PutObject when the server-side encryption header is not aws:kms
- B. Enable versioning on the bucket
- C. Enable server access logging
- D. Add a lifecycle rule that transitions objects after 30 days
Show answer
Answer: A
A Deny statement on s3:PutObject with a condition that the s3:x-amz-server-side-encryption header is not aws:kms rejects non-compliant uploads explicitly. Turning on versioning or logging does not control encryption, and a lifecycle rule acts on objects after upload and cannot reject a request.
Want more questions like this? Full DVA-C03 practice tests →
Testing and Deployment
Question 12. A CodeBuild project needs a third-party API token during the build. The token must not appear in the repository or in the project configuration as plain text. What is the best approach?
- A. Commit the token to the repository in a config file
- B. Add the token as a plain text environment variable on the project
- C. Store the token in a public S3 object and download it in the build
- D. Reference the token from Secrets Manager or Parameter Store in the buildspec env section
Show answer
Answer: D
The buildspec can load values into environment variables from Secrets Manager or Systems Manager Parameter Store, and the build role is allowed to read only those entries. Committing the token, writing it in a plain text environment variable or putting it in the buildspec exposes it to anyone with access. A public S3 object is also exposed.
Want more questions like this? Full DVA-C03 practice tests →
Question 13. You deploy to EC2 instances with CodeDeploy. After the new version is installed, the deployment must run a script that checks the application responds, and fail the deployment if it does not. Which appspec lifecycle hook fits?
- A. BeforeInstall
- B. ValidateService
- C. ApplicationStop
- D. DownloadBundle
Show answer
Answer: B
ValidateService is the last hook of an EC2 or on-premises deployment, designed to verify that the deployment completed successfully, and a script failure fails the deployment. BeforeInstall runs before the files are copied, ApplicationStop runs against the previous revision before the new one is installed, and DownloadBundle is an agent step that cannot be scripted.
Want more questions like this? Full DVA-C03 practice tests →
Question 14. A team wants to see which resources a CloudFormation stack update would replace or modify before it runs, so a database is not replaced by accident. What should they do?
- A. Run drift detection on the stack
- B. Disable rollback on failure
- C. Create a change set and review it
- D. Attach a stack policy to the stack
Show answer
Answer: C
A change set shows the proposed changes, including whether a resource is modified or replaced, and nothing changes until you execute it. Detecting drift compares the live resources with the template and does not preview an update, rollback settings act after a failure, and a stack policy blocks updates rather than describing them.
Want more questions like this? Full DVA-C03 practice tests →
Question 15. A Lambda function's code reads from DynamoDB. The team wants fast unit tests that run on every commit without needing an AWS account or network access. What should they do?
- A. Mock or stub the DynamoDB client in the tests
- B. Run the tests against the production table
- C. Run the tests only after deploying to production
- D. Skip tests and rely on CloudWatch alarms
Show answer
Answer: A
Unit tests should isolate the code under test, so the SDK client is replaced with a mock or stub, or a local emulator that implements the API, and the test checks the logic and the calls made. Pointing tests at the production table is slow, risky and needs credentials, and running tests only after production deployment does not give fast feedback on each commit.
Want more questions like this? Full DVA-C03 practice tests →
Question 16. A feature must be turned on for 10 percent of users first, widened gradually, and switched off quickly if error alarms fire. The team does not want to redeploy the application for each change. Which service fits?
- A. A new Lambda function version for each percentage
- B. A Systems Manager Parameter Store parameter edited by hand
- C. A Lambda environment variable changed in the console
- D. AWS AppConfig feature flags with a gradual deployment strategy
Show answer
Answer: D
AWS AppConfig delivers feature flags and configuration with a deployment strategy that rolls out gradually and can monitor CloudWatch alarms to roll back automatically, without redeploying code. A new Lambda version per change needs a deployment, a Parameter Store parameter has no gradual rollout, and a manual environment variable edit offers no staged release or automatic rollback.
Want more questions like this? Full DVA-C03 practice tests →
Troubleshooting and Optimization
Question 17. During a sales event a business-critical Lambda function is throttled because a batch job in the same account and Region uses most of the account's concurrency. How do you guarantee the critical function can always run?
- A. Increase the memory of the critical function
- B. Set reserved concurrency on the critical function
- C. Increase the timeout of the batch function
- D. Add a function URL to the critical function
Show answer
Answer: B
Reserved concurrency sets aside part of the account’s concurrency for that function, which both guarantees it capacity and caps it at that number. A larger memory size does not change the concurrency available, a longer timeout makes functions hold slots longer, and a function URL is a way to invoke a function, not a capacity control.
Want more questions like this? Full DVA-C03 practice tests →
Question 18. A Lambda function that resizes images is CPU-bound and takes 9 seconds. Its memory is set to 128 MB, and the logs show it uses about 90 MB. What is the simplest change that is likely to make it faster?
- A. Reduce the ephemeral storage (/tmp) size
- B. Add reserved concurrency
- C. Increase the configured memory
- D. Increase the timeout to 15 minutes
Show answer
Answer: C
Lambda allocates CPU power in proportion to configured memory, so raising memory gives the function more CPU even if the memory is not used. Because billing is based on duration times memory, a faster run can cost the same or less, and a tool such as AWS Lambda Power Tuning finds the best setting. Reducing ephemeral storage does not add CPU, reserved concurrency does not add CPU either, and a longer timeout only allows slowness.
Want more questions like this? Full DVA-C03 practice tests →
Question 19. An application writes structured JSON logs to CloudWatch Logs. The team must count errors per customer ID over the last three hours, across several log streams, within minutes. What should they use?
- A. A CloudWatch Logs Insights query with filter and stats by customer ID
- B. Download all log streams and search them locally
- C. An AWS X-Ray service map
- D. The AWS Cost and Usage Report
Show answer
Answer: A
CloudWatch Logs Insights queries one or more log groups, discovers JSON fields and supports filter and stats commands, so counting errors grouped by customer ID is a short query. Downloading logs to a laptop is slow and manual, X-Ray traces show request paths rather than log aggregates, and billing reports have nothing to do with application errors.
Want more questions like this? Full DVA-C03 practice tests →
Question 20. Containers in an ECS task stop under load, and the stopped task shows exit code 137 with the memory limit reached. What is the most likely cause and fix?
- A. Log retention is too short; increase it
- B. The subnet is full; add another subnet
- C. The desired count is too high; lower it
- D. The container exceeded its memory limit; raise the memory or reduce usage
Show answer
Answer: D
Exit code 137 means the container was killed with SIGKILL, and when a container exceeds its hard memory limit it is killed by the out-of-memory handling, so the task or container memory has to be raised or the application’s memory use reduced. A bigger log retention, another subnet or a lower desired count do not change the memory limit that was exceeded.
Want more questions like this? Full DVA-C03 practice tests →
How did you do?
Seventeen or more correct is a good sign. Questions 1 to 6 cover the largest domain, so if you missed more than two, work through development with AWS services first. Misses on 7 to 11 point to the security guide, on 12 to 16 to testing and deployment, and on 17 to 20 to troubleshooting and optimization. The sample questions give five more, and the study plan schedules timed practice for the final week.