DVA-C02 question patterns

Use the built-in feature: Lambda, SQS, Step Functions, API Gateway service integration, managed rotation.

Custom code, cron jobs and servers add work to maintain.

AppConfig, Parameter Store, stage variables or an alias move.

Environment variables need a new function version to change.

Execution, instance or task role with least privilege.

Roles give temporary credentials. Keys in code or config leak.

Idempotency key checked with a DynamoDB conditional write.

SQS standard, Lambda retries and client retries are all at least once.

Topic with an SQS queue per consumer, plus filter policies if needed.

Each queue buffers separately and fails separately.

Redrive policy with maxReceiveCount and a DLQ with longer retention.

Isolates poison messages for inspection and redrive.

State machine with Retry, Catch and waitForTaskToken.

Lambda calling Lambda has no state and bills waiting.

Event bus with rules and targets.

Rules match on event fields and fan out to many targets.

Exponential backoff with jitter, SDK retry modes.

Jitter stops clients retrying in lockstep.

On-failure destination (preferred) or a DLQ.

Async calls retry twice, then discard.

Bisect batch on error, max retry attempts, max record age, on-failure destination.

A failing batch blocks the shard until it succeeds or expires.

Return failed item IDs with ReportBatchItemFailures.

Only failed messages go back to the queue.

Subnets and security groups, plus RDS Proxy for connection pooling.

Lambda scaling can exhaust database connections.

NAT gateway or VPC endpoints.

VPC functions have no outbound route by default.

Provisioned concurrency (SnapStart for supported runtimes).

Environments stay initialized.

Power Tuning, init outside the handler, arm64.

CPU scales with memory, so more memory can cost less.

Global secondary index (eventually consistent, any time).

LSIs need the same partition key and table creation time.

Higher-cardinality partition key or write sharding, DAX for hot reads.

A hot partition throttles on its own.

Query on key or index with projection.

Scan reads the whole table.

DAX cluster.

Write-through cache for eventually consistent reads.

User pool with JWTs and an API Gateway authorizer.

User pools authenticate.

Identity pool with IAM roles, after user pool sign-in.

Identity pools issue temporary AWS credentials.

Lambda authorizer returning a policy, cached by token.

Handles non-Cognito tokens.

GenerateDataKey, encrypt locally, store encrypted key.

KMS Encrypt handles 4 KB only.

Key policy plus caller's IAM policy.

AWS managed keys cannot be shared.

Secrets Manager rotation.

Parameter Store has no built-in rotation.

Presigned PUT or GET with short expiry.

Carries signer's permissions and ends with the signing session.

Key group, signed cookies for many files, OAC on S3.

Restricts access at the edge.

Interface VPC endpoint (PrivateLink) for Bedrock.

Keeps traffic on the AWS network.

Guardrail on input and output, or ApplyGuardrail.

One reusable policy across models.

Confirmation step, narrow tool roles, per-tool authorization.

Limits blast radius of a manipulated agent.

KMS encryption, restricted access, short retention, masking.

Invocation logs hold what users typed.

Converse or InvokeModel with a least-privilege role, backoff and timeouts.

Model calls are slow and rate limited.

Write a spec first and let the tool generate design, tasks and code (Kiro).

The spec stays the source of truth. Review and test the output.

AutoPublishAlias with canary or linear, alarms and hooks.

CodeDeploy shifts the alias and rolls back.

Alias, CodeDeploy blue/green or Beanstalk URL swap.

Old environment stays ready.

Immutable (or traffic splitting for a canary).

Full capacity throughout, easy rollback.

Stage variable in integration URI to an alias.

One API definition, per-stage backend.

AppConfig profile with validators and a gradual strategy.

Config changes without code deploys.

Approval action with SNS notification.

Automated gates come from tests and alarms.

Print an embedded metric format JSON line.

No PutMetricData calls or added latency.

Service map and traces, active tracing on Lambda.

Shows latency and errors per hop.

Annotations are indexed, metadata is not.

Filter expressions use annotations.

Query with filter and stats.

Queries multiple log groups.

Fix the response shape or the crash.

504 is timeout, 429 is throttling.

Check path, port, matcher and security groups.

The check is wrong, not the app.

Filter policy on the subscription.

Avoids code that discards messages.

Use it as a lead and confirm with logs, traces and a test.

AI can be wrong about APIs and your environment.