AWS Certified Developer – Associate (DVA-C02) Exam 2026:
Professional Certification Practice Test — AWS Development,
Serverless Applications, Security, Deployment, Monitoring &
Troubleshooting — 190 Multiple-Choice Questions with Answers &
Detailed Rationales
Domain 1: AWS Fundamentals, IAM, and Security (Questions 1–30)
Question 1
A developer needs to grant an EC2 instance permission to read objects from an S3 bucket
without storing credentials on the instance. Which approach is MOST secure?
A. Store IAM user access keys in a configuration file on the instance.
B. Attach an IAM role to the instance with the required S3 permissions.
C. Embed credentials in the application source code.
D. Create an IAM group and add the instance to it.
Correct Answer: B
Explanation: IAM roles provide temporary credentials to EC2 instances via instance
metadata, eliminating hardcoded secrets. This is AWS best practice for granting AWS service
access to compute resources.
Question 2
,A developer is writing code that calls AWS APIs and wants to avoid managing long-term
credentials. The application runs on an on-premises server. Which solution provides
temporary credentials?
A. IAM user with programmatic access keys
B. AWS STS AssumeRole with an IAM role
C. Root account access keys
D. S3 presigned URLs
Correct Answer: B
Explanation: AWS STS AssumeRole returns temporary credentials usable from on-premises.
It supports rotation and least privilege, unlike long-lived IAM user keys stored locally.
Question 3
Which IAM policy element specifies the AWS service or resource the statement applies to?
A. Effect
B. Action
C. Resource
D. Principal
Correct Answer: C
Explanation: The Resource element identifies the specific AWS resource (e.g., an S3 bucket
ARN). Action defines operations, Effect allows or denies, and Principal applies in trust
policies.
,Question 4
A developer must allow an application to assume a role only when MFA is present. Which
condition key should be used in the trust policy?
A. aws:SourceIp
B. aws:MultiFactorAuthPresent
C. aws:RequestedRegion
D. aws:UserAgent
Correct Answer: B
Explanation: aws:MultiFactorAuthPresent is a Boolean condition key that enforces MFA
presence. It is commonly used in trust policies to strengthen role assumption security.
Question 5
An application needs to access DynamoDB and S3. What is the BEST way to configure
permissions following least privilege?
A. Attach AdministratorAccess to the EC2 role.
B. Create a custom policy granting only required DynamoDB and S3 actions.
C. Use root account credentials.
D. Grant full access to all AWS services.
Correct Answer: B
Explanation: Least privilege requires granting only the specific actions and resources needed.
Custom scoped policies minimize blast radius if credentials are compromised.
, Question 6
A developer wants to rotate access keys automatically for an IAM user. Which service should
be used?
A. AWS Config
B. AWS Secrets Manager
C. AWS CloudTrail
D. Amazon Inspector
Correct Answer: B
Explanation: Secrets Manager can store, rotate, and retrieve credentials automatically using
Lambda rotation functions. It reduces risk from stale or leaked long-term keys.
Question 7
Which AWS service records API activity for auditing and security analysis?
A. Amazon CloudWatch
B. AWS CloudTrail
C. AWS Config
D. AWS Trusted Advisor
Correct Answer: B
Explanation: CloudTrail logs API calls, including identity, time, source IP, and request details.
It is essential for auditing, compliance, and security investigations.
Professional Certification Practice Test — AWS Development,
Serverless Applications, Security, Deployment, Monitoring &
Troubleshooting — 190 Multiple-Choice Questions with Answers &
Detailed Rationales
Domain 1: AWS Fundamentals, IAM, and Security (Questions 1–30)
Question 1
A developer needs to grant an EC2 instance permission to read objects from an S3 bucket
without storing credentials on the instance. Which approach is MOST secure?
A. Store IAM user access keys in a configuration file on the instance.
B. Attach an IAM role to the instance with the required S3 permissions.
C. Embed credentials in the application source code.
D. Create an IAM group and add the instance to it.
Correct Answer: B
Explanation: IAM roles provide temporary credentials to EC2 instances via instance
metadata, eliminating hardcoded secrets. This is AWS best practice for granting AWS service
access to compute resources.
Question 2
,A developer is writing code that calls AWS APIs and wants to avoid managing long-term
credentials. The application runs on an on-premises server. Which solution provides
temporary credentials?
A. IAM user with programmatic access keys
B. AWS STS AssumeRole with an IAM role
C. Root account access keys
D. S3 presigned URLs
Correct Answer: B
Explanation: AWS STS AssumeRole returns temporary credentials usable from on-premises.
It supports rotation and least privilege, unlike long-lived IAM user keys stored locally.
Question 3
Which IAM policy element specifies the AWS service or resource the statement applies to?
A. Effect
B. Action
C. Resource
D. Principal
Correct Answer: C
Explanation: The Resource element identifies the specific AWS resource (e.g., an S3 bucket
ARN). Action defines operations, Effect allows or denies, and Principal applies in trust
policies.
,Question 4
A developer must allow an application to assume a role only when MFA is present. Which
condition key should be used in the trust policy?
A. aws:SourceIp
B. aws:MultiFactorAuthPresent
C. aws:RequestedRegion
D. aws:UserAgent
Correct Answer: B
Explanation: aws:MultiFactorAuthPresent is a Boolean condition key that enforces MFA
presence. It is commonly used in trust policies to strengthen role assumption security.
Question 5
An application needs to access DynamoDB and S3. What is the BEST way to configure
permissions following least privilege?
A. Attach AdministratorAccess to the EC2 role.
B. Create a custom policy granting only required DynamoDB and S3 actions.
C. Use root account credentials.
D. Grant full access to all AWS services.
Correct Answer: B
Explanation: Least privilege requires granting only the specific actions and resources needed.
Custom scoped policies minimize blast radius if credentials are compromised.
, Question 6
A developer wants to rotate access keys automatically for an IAM user. Which service should
be used?
A. AWS Config
B. AWS Secrets Manager
C. AWS CloudTrail
D. Amazon Inspector
Correct Answer: B
Explanation: Secrets Manager can store, rotate, and retrieve credentials automatically using
Lambda rotation functions. It reduces risk from stale or leaked long-term keys.
Question 7
Which AWS service records API activity for auditing and security analysis?
A. Amazon CloudWatch
B. AWS CloudTrail
C. AWS Config
D. AWS Trusted Advisor
Correct Answer: B
Explanation: CloudTrail logs API calls, including identity, time, source IP, and request details.
It is essential for auditing, compliance, and security investigations.
