AWS DVA-C03 Practice Exam

• A. Pass an access key ID and secret key to the client constructor
• B. Create the client and let the SDK credential chain find the role Correct answer
• C. Read an access key pair from the instance user data at startup
• D. Call GetSessionToken with long-term keys from an IAM user

Option B is correct because the SDK default credential provider chain automatically retrieves temporary, auto-rotating credentials from the instance profile through the instance metadata service, so no keys are ever handled in code. Options A and C put long-term keys in code or user data, which is insecure and unnecessary, and option D relies on long-term IAM user keys instead of the role.

• A. Increase the ephemeral storage size to 10,240 MB
• B. Increase the memory allocated to the function Correct answer
• C. Configure provisioned concurrency for the function
• D. Add a layer that contains a faster compression library

Option B is correct because Lambda allocates CPU power in proportion to configured memory, so raising memory above 128 MB gives a CPU-bound compression task more CPU and shortens duration with no code change. Ephemeral storage (A) adds only disk space, provisioned concurrency (C) removes cold starts but does not speed up execution, and a layer (D) would need code changes to use a different library.

• A. Enable auto scaling to raise the provisioned write capacity
• B. Create a global secondary index on the Status attribute
• C. Add a retry loop with exponential backoff to the write calls
• D. Choose a high-cardinality attribute such as OrderId as the partition key Correct answer

Option D is correct because a partition key with only three values concentrates traffic on a few partitions, so those hot partitions throttle even though total consumed capacity is low. A high-cardinality key such as OrderId spreads writes evenly. Auto scaling (A) raises table capacity but not the per-partition limit, a GSI on Status (B) has the same low-cardinality problem, and retries (C) only mask the symptom.

• A. The function must set MaximumRetryAttempts to at least 1
• B. A dead-letter queue must be configured before a destination takes effect
• C. On-failure destinations apply to synchronous invocations, not asynchronous ones
• D. The execution role lacks the sqs:SendMessage permission on the queue Correct answer

Option D is correct because Lambda sends the failed event to a destination using the function's execution role, which here has only basic logging permissions, so the send to SQS is denied. It needs sqs:SendMessage on the queue. Destinations are designed for asynchronous invocations (C is wrong), they do not require a dead-letter queue (B), and retries can be set to 0 and still deliver failures (A).

• A. Call Textract DetectDocumentText to return the form fields and tables
• B. Call Translate TranslateText on the audio files
• C. Call Transcribe StartTranscriptionJob for the audio files Correct answer
• D. Call Comprehend DetectEntities on the scanned images
• E. Call Textract AnalyzeDocument with the FORMS and TABLES feature types Correct answer

Options C and E are correct. Transcribe StartTranscriptionJob converts recorded audio to text, and Textract AnalyzeDocument with the FORMS and TABLES feature types extracts key-value form fields and tables. DetectDocumentText (A) returns only raw lines and words, not form fields or tables. Translate (B) translates text rather than audio, and Comprehend (D) analyzes text, not images.

• A. The URL is valid until the temporary credentials that signed it expire Correct answer
• B. Signature Version 4 limits presigned URL lifetime to one hour
• C. The bucket policy overrides the URL expiration with a one-hour default
• D. S3 ignores the expiration parameter for presigned GET requests

Option A is correct because a presigned URL is signed with the caller's credentials and stops working when those credentials expire. Credentials from AssumeRole with a 3600-second duration last one hour, so the 12-hour URL fails after about an hour. SigV4 allows up to 7 days for IAM user keys (B), a bucket policy does not rewrite the expiration (C), and S3 honors the expiration parameter (D).

• A. Call GenerateDataKey and encrypt the file locally with it Correct answer
• B. Call ReEncrypt to wrap each file under the KMS key directly
• C. Enable automatic rotation to lift the Encrypt data size limit
• D. Switch to an asymmetric KMS key so Encrypt accepts larger input

Option A is correct because KMS Encrypt accepts at most 4 KB of data, so larger files use envelope encryption: GenerateDataKey returns a data key to encrypt the file locally, with its encrypted copy stored alongside. ReEncrypt (B) only moves existing ciphertext between keys, rotation (C) does not change the size limit, and asymmetric keys (D) have an even smaller limit.

• A. Add the application's own IAM identity to the role trust policy
• B. Pass the returned session token as a header on put_object
• C. Call GetSessionToken with the role ARN before each put_object
• D. Create a new S3 client with the returned temporary credentials Correct answer

Option D is correct because an existing client keeps using the credentials it was created with, so AssumeRole's result has no effect on it. The developer must build a new S3 client from the returned temporary access key, secret key and session token. The trust policy is evidently fine since AssumeRole succeeded (A), the session token is not a put_object header (B), and GetSessionToken does not take a role ARN (C).

• A. Add a denied topic that describes investment advice Correct answer
• B. Turn on model invocation logging to Amazon S3
• C. Set the prompt attack filter strength to HIGH
• D. Add EMAIL to the guardrail's sensitive information filters Correct answer
• E. Lower the temperature inference parameter to 0

Options A and D are correct. A denied topic makes the guardrail block investment advice questions, and adding EMAIL as a sensitive information filter lets the guardrail block or mask email addresses in responses. Invocation logging (B) only records traffic, the prompt attack filter (C) targets jailbreaks and prompt injection, and temperature (E) affects randomness, not content policy.

• A. Sign the call with the app client secret instead of a token
• B. Send the refresh token in the Logins map under the app client ID
• C. Send the ID token under the user pool provider name in Logins Correct answer
• D. Add the access token scopes to the identity pool role mapping rules

Option C is correct because the Logins map for a Cognito user pool provider must carry the user pool ID token, keyed by the provider name cognito-idp.<region>.amazonaws.com/<userPoolId>. Access tokens and refresh tokens are not accepted there, and a client secret does not sign this call. Role mapping rules read claims from the ID token, not access token scopes.

• A. Use DeploymentPreference with Canary10Percent10Minutes and the alarm Correct answer
• B. Shift the alias weights by hand and watch the alarm
• C. Use Route 53 weighted records across two API stages
• D. Use DeploymentPreference with Linear10PercentEvery10Minutes

Option A is correct because the SAM DeploymentPreference property with Canary10Percent10Minutes sends 10 percent of traffic to the new version for 10 minutes and then shifts the rest, with CodeDeploy rolling back automatically if the listed alarm fires. Manual alias shifting (B) and Route 53 across stages (C) add operational work, and Linear10PercentEvery10Minutes (D) increases traffic gradually rather than the one-step shift required.

• A. Set QUEUE_URL to !Ref OrdersQueue in the Environment section Correct answer
• B. Add sqs:SendMessage for OrdersQueue to the function policies
• C. Add a DependsOn attribute for OrdersQueue to the function
• D. Set QUEUE_URL to !GetAtt OrdersQueue.QueueName instead

Option A is correct because for an AWS::SQS::Queue the Ref intrinsic function returns the queue URL, which is what SendMessage needs as QueueUrl. GetAtt Arn returns the ARN, which is not a valid address. Adding permissions (B) or DependsOn (C) does not change the value, and QueueName (D) is not a URL either.

• A. Call GetParameter on Parameter Store from the handler on each invocation
• B. Add a CloudWatch alarm monitor to the AppConfig environment
• C. Bundle a settings file in the package and publish a new version per change
• D. Attach a JSON Schema validator to the configuration profile Correct answer
• E. Add the AppConfig Lambda extension layer and read from its local endpoint Correct answer

Options D and E are correct because a JSON Schema validator on the configuration profile makes AppConfig reject malformed JSON before any deployment starts, and the AppConfig Lambda extension caches the configuration locally and refreshes it in the background, so changed settings arrive without a redeployment or an AppConfig API call per invocation. Option A uses Parameter Store, not AppConfig, and calls an API on every invocation. Option B only monitors and rolls back after a deployment has begun, and option C requires a new package version for every change.

• A. Add --capabilities CAPABILITY_AUTO_EXPAND to the command
• B. Replace the capability with CAPABILITY_NAMED_IAM in the command Correct answer
• C. Attach the AdministratorAccess policy to the identity that deploys
• D. Run sam build --use-container before deploying again

Option B is correct because an IAM role with an explicit RoleName is a custom-named IAM resource, and CloudFormation then requires the CAPABILITY_NAMED_IAM capability; CAPABILITY_IAM only covers IAM resources with generated names. CAPABILITY_AUTO_EXPAND is for macros and nested applications, extra permissions on the deployer do not replace the capability acknowledgement, and sam build has no effect on it.

• A. Add a parameter of type AWS::SSM::Parameter::Value<String> for /app/ami Correct answer
• B. Set the password to {{resolve:secretsmanager:prod/db:SecretString:password}} Correct answer
• C. Set the AMI ID by using Fn::ImportValue with the export name /app/ami
• D. Set the password to {{resolve:ssm-secure:prod/db:SecretString:password}}
• E. Read the password by using Fn::GetAtt on the secret name prod/db

Options A and B are correct. A parameter of type AWS::SSM::Parameter::Value<String> pulls the current plaintext Parameter Store value at deploy time, and a secretsmanager dynamic reference resolves the secret without storing the password in the template. Fn::ImportValue only reads stack exports, ssm-secure reads SSM SecureString parameters, not Secrets Manager secrets, and Fn::GetAtt cannot read a secret by name.

• A. Run the X-Ray daemon as a sidecar process in the function
• B. Enable detailed monitoring for the function
• C. Create a sampling rule that matches the function name
• D. Turn on active tracing in the function's configuration Correct answer

Option D is correct because enabling active tracing in the Lambda function configuration makes Lambda sample requests and send trace data to X-Ray, with no code or daemon changes. Lambda runs the daemon itself, so a sidecar (A) is not needed. Detailed monitoring (B) is not a Lambda feature for tracing, and a sampling rule (C) tunes sampling but does not turn tracing on.

• A. Set isBase64Encoded to true in the returned dictionary
• B. Add a Content-Type header to the returned dictionary
• C. Convert the body value to a string with json.dumps Correct answer
• D. Extend the integration timeout beyond 29 seconds

Option C is correct because a Lambda proxy integration requires the body field to be a string. Returning a dictionary makes the response malformed, so API Gateway returns 502 even though the function succeeded. Serializing it with json.dumps fixes this. isBase64Encoded (A) and Content-Type (B) are not what makes the response invalid, and the timeout (D) is unrelated because the function completed.

• A. Write each database update to the cache in the same code path
• B. Query the database on a cache miss and store the result Correct answer
• C. Preload the full catalog into the cache at application startup
• D. Configure the noeviction memory policy on the Redis cluster
• E. Set a 600-second expiration when writing each item to the cache Correct answer

Options B and E are correct. Lazy loading queries the database on a cache miss and stores the result, so only requested items enter the cache, and a 600-second TTL guarantees no item lives longer than 10 minutes. Writing every update to the cache (A) and preloading the catalog (C) fill the cache with items nobody requested, and noeviction (D) controls memory-full behavior, not item lifetime.

• A. Catch the TooManyRequestsException that the SDK raises when the code fails
• B. Check the FunctionError field in the Invoke response Correct answer
• C. Read the X-Amz-Log-Result header to get the real status of the run
• D. Switch to the Event invocation type so that the SDK reports code errors

Option B is correct because a synchronous Invoke returns HTTP 200 even when the function code raises an unhandled exception; the failure is reported in the FunctionError field of the response, which the code must check. Option A is wrong because TooManyRequestsException signals throttling, not code failure. Option C only returns the log tail, and option D (Event invocation) is asynchronous and returns no function result at all.

• A. Turn on API caching with a time to live of five minutes
• B. Turn on detailed CloudWatch metrics for the stage
• C. Associate an AWS WAF web ACL with logging enabled to the stage
• D. Turn on X-Ray tracing for the stage and the function Correct answer
• E. Turn on execution logging with full request data for the stage Correct answer

Options D and E are correct because execution logging with full request data records the payload API Gateway sends to the integration, and X-Ray tracing on the stage and function shows the timing of each downstream call within a request. Caching (A) and detailed metrics (B) give no per-request payload or segment timing, and WAF logging (C) records web ACL evaluations, not integration payloads.