Read this the night before or on exam morning. It assumes you’ve studied the notes. It’s here to refresh, not to teach.
Exam day
- 65 questions in 130 minutes: 50 scored and 15 unscored questions you can’t spot. Scaled score 100 to 1,000; you need 720. Multiple choice and multiple response.
- About 2 minutes per question. No penalty for guessing, and unanswered questions count as wrong, so never leave one blank. Flag and move on.
- Compensatory scoring: you only need to pass overall, not each domain.
- Domain weights: Development with AWS services 30%, Security 26%, Testing and deployment 22%, Troubleshooting and optimization 22%.
- DVA-C03 replaces DVA-C02. C03 registration opened 27 October 2026, and the last day for C02 is 30 November 2026.
What changed from DVA-C02
- Weights moved: Development 32 to 30, Deployment (now Testing and Deployment) 24 to 22, Troubleshooting 18 to 22. Security stays 26.
- New task 2.3: security of AI services. VPC endpoints (PrivateLink) for private access, inputs and outputs not used for training, Bedrock Guardrails (content filters, denied topics, PII masking, prompt attack protection), agent tool authorization, session isolation, human approval for sensitive actions, protecting sensitive text in logs.
- AI-assisted work is tested in development (generate, review and refactor code, spec-driven development, managed AI services), testing (AI-generated tests), CI/CD, troubleshooting and optimization. Foundation model choice, prompt engineering and RAG design are out of scope.
- New or expanded elsewhere: presigned URLs (S3 and CloudFront), building container images and ECR lifecycle, deploying to ECS and EKS (task definitions, manifests, Fargate, rolling updates), health checks with liveness and readiness probes, concurrency and connection pooling, graceful degradation.
- Moved: unit testing with SAM now sits under testing, Lambda tuning under optimization, API Gateway stages under artifact preparation, serialization under application code.
- DynamoDB, encryption and sensitive data, testing and some observability skills were merged into fewer, broader skills. The topics still count.
- In-scope list now names Bedrock, Bedrock AgentCore, Amazon Quick and Kiro. It no longer lists AppSync, CodeGuru, Copilot or MemoryDB, but older material covers them, so treat them as low priority.
How to read a DVA question
Read the last sentence first, then find the constraint words:
| The question says | Pick |
|---|---|
| Least operational overhead | Managed or serverless feature built in. No custom code or servers |
| Most secure, no credentials in code | IAM role, Secrets Manager or Parameter Store, KMS |
| Decouple, absorb spikes, must not lose messages | SQS (with DLQ). SNS then SQS for fanout |
| Without changing code | Configuration: AppConfig, stage variables, aliases, environment settings |
| Reduce cost of reads / latency | Caching: DAX, ElastiCache, CloudFront, API Gateway cache |
| Gradual release with rollback | Lambda alias weights or CodeDeploy canary/linear with alarms |
| Block harmful AI output, mask PII, stop prompt injection | Bedrock Guardrails |
| AI traffic must not use the internet | Interface VPC endpoint (PrivateLink) |
| Agent takes a sensitive action | Human-in-the-loop confirmation, narrow tool permissions |
Elimination tricks
- Anything that hard-codes keys, stores secrets in plaintext environment variables or opens SSH is wrong.
Scanis almost never the answer. PreferQueryor an index.- Retrying a 4xx error never helps. Throttling and 5xx do.
- In Choose TWO questions, each pick is a different piece of one solution.
Lambda numbers
| Thing | Value |
|---|---|
| Memory | 128 MB to 10,240 MB (CPU scales with it) |
| Timeout | Default 3 s, max 900 s |
/tmp |
512 MB to 10,240 MB |
| Zip package | 50 MB zipped, 250 MB unzipped with layers. Container 10 GB |
| Layers | 5 per function |
| Environment variables | 4 KB total |
| Sync payload | 6 MB. Async 256 KB (older limit) |
| Account concurrency | 1,000 default per Region |
| Async retries | 2 more attempts, up to 6 hours of event age |
| Stream consumer | Failing batch blocks the shard |
| SQS visibility timeout | At least 6x the function timeout |
Service limits to remember
| Thing | Value |
|---|---|
| SQS message size / retention | 1 MiB / 1 minute to 14 days (default 4) |
| SQS visibility timeout | 30 s default, 12 h max |
| SQS long polling | Up to 20 s |
| SQS FIFO throughput | 300/s per action, 3,000 with batching |
| Kinesis shard | In 1 MB/s or 1,000 records/s. Out 2 MB/s. Retention 24 h to 365 days |
| DynamoDB item size | 400 KB |
| DynamoDB batch | 100 get, 25 write. Query page 1 MB |
| DynamoDB indexes | LSI 5 (at creation only), GSI 20 |
| DynamoDB Streams | 24 hours |
| DynamoDB PITR | 35 days |
| API Gateway timeout | 29 s (REST). Payload 10 MB |
| API Gateway cache TTL | 300 s default, 3,600 max |
| S3 object | 5 GB single PUT, 5 TB max. Multipart from 100 MB advised |
| KMS direct encrypt | 4 KB |
| KMS key deletion | 7 to 30 days waiting |
| Step Functions | Standard up to 1 year. Express up to 5 minutes |
| X-Ray sampling default | 1 per second plus 5% |
DynamoDB maths
- 1 RCU: one strongly consistent read per second up to 4 KB (two eventually consistent, half a transactional).
- 1 WCU: one write per second up to 1 KB. Transactions cost double.
- Round the item size up. Reads in 4 KB steps, writes in 1 KB steps.
- 100 strongly consistent reads per second of 8 KB items = 100 x 2 = 200 RCU. Eventually consistent = 100 RCU.
- 50 writes per second of 2.5 KB items = 50 x 3 = 150 WCU.
- Filter expressions don’t reduce consumed capacity. GSIs are eventually consistent only.
Deployment facts
CodeDeploy EC2 in-place hook order: ApplicationStop → DownloadBundle → BeforeInstall → Install → AfterInstall → ApplicationStart → ValidateService.
Lambda hooks: BeforeAllowTraffic, AfterAllowTraffic.
| Need | Pick |
|---|---|
| Zero downtime, instant rollback | Blue/green (Beanstalk CNAME swap, CodeDeploy blue/green) |
| New fleet, no capacity loss | Beanstalk Immutable |
| Test a small share first | Canary, traffic splitting, weighted alias |
| Cheapest, downtime OK | All at once |
| Shared libraries | Lambda layer |
| Feature flag without redeploy | AppConfig |
| Per-stage backends | API Gateway stage variables to Lambda aliases |
| Private packages | CodeArtifact |
buildspec.yml phases: install, pre_build, build, post_build. appspec.yml at the bundle root. SAM template needs Transform: AWS::Serverless-2016-10-31.
Security facts
- Explicit deny wins. Cross-account needs allow on both sides. Same account needs one.
- Cognito user pool = who you are (JWTs). Identity pool = temporary AWS credentials.
AssumeRoleWithWebIdentityfor OIDC,AssumeRoleWithSAMLfor SAML,AssumeRolefor roles.- KMS: symmetric keys never leave KMS. Customer managed keys can be shared and rotated (optional automatic rotation). AWS managed keys rotate yearly and can’t be shared.
- Envelope encryption:
GenerateDataKey, encrypt locally, store the encrypted key beside the data. - Secrets Manager rotates secrets. Parameter Store
SecureStringis cheaper with no built-in rotation. - ACM certificates for CloudFront must be in us-east-1. They can’t be exported to EC2.
Error codes
| Code | Think |
|---|---|
| 400 | Bad input or failed validation |
| 401/403 | Missing credentials / not allowed (IAM, WAF, key, authorizer) |
| 429 | Throttled: back off, raise limits, reserve concurrency |
| 502 | Bad Lambda response format or crash |
| 503 | Service unavailable, retry |
| 504 | Integration timeout (29 s) |
Pairs people mix up
| A | B | The difference |
|---|---|---|
| SQS | SNS | Pull queue / push topic. Combine for fanout |
| Standard queue | FIFO queue | At least once, any order / ordered, deduplicated |
| Query | Scan | By partition key / whole table |
| LSI | GSI | Same partition key, creation only / any key, any time |
| Reserved concurrency | Provisioned concurrency | Guarantee and cap / pre-warmed environments |
| DLQ on function | Destination | Basic failure queue / success and failure with context |
| X-Ray annotation | Metadata | Indexed and filterable / not indexed |
| Metric filter | Subscription filter | Logs to metric / logs to stream |
| EMF | PutMetricData | Metrics from a log line / synchronous API call |
| Secrets Manager | Parameter Store | Rotation, paid / config and cheap |
| SSE-KMS | SSE-S3 | Audited key control / managed by S3 |
| Lambda proxy | Non-proxy | Event passed as is, function shapes response / templates transform |
| Edge-optimized | Regional API | Through CloudFront / local clients |
| CloudFormation | SAM | General IaC / serverless extension that compiles to it |
| Cache policy | Origin request policy | What forms the cache key / what is forwarded |
AI-related facts
- Bedrock:
InvokeModel(model-specific body) andConverse(one request shape for many models, with streaming variants). Role needsbedrock:InvokeModelon the model ARN. - Guardrails apply to input and output, attach to a call or run alone through
ApplyGuardrail. - Bedrock does not train base models on your inputs and outputs.
- Treat AI-generated code like a pull request: review, test, scan. Treat model output as untrusted before it triggers actions.
- AI tools help with generating tests, approvals, error analysis and optimization hints, but humans own the production decision.
Defaults that are usually right
- IAM roles with least privilege, never keys in code.
- SDK clients created outside the Lambda handler.
- SQS with a DLQ and idempotent consumers.
- Step Functions for orchestration instead of Lambda calling Lambda.
- Cognito for app users, with the API Gateway Cognito authorizer.
- X-Ray active tracing plus structured JSON logs with a correlation ID.
- SAM for serverless deploys, with alias traffic shifting and alarms.