AWS • DVA-C02
Validates ability to develop, test, deploy, and debug AWS Cloud-based applications using AWS services.
Questions
536
Duration
130 minutes
Passing Score
720/1000
Difficulty
AssociateLast Updated
Jan 2026
The AWS Certified Developer – Associate (DVA-C02) is an intermediate-level certification from Amazon Web Services that validates a candidate's proficiency in developing, testing, deploying, and debugging cloud-based applications on the AWS platform. It demonstrates hands-on competency with core AWS developer services including AWS Lambda, Amazon API Gateway, Amazon DynamoDB, Amazon S3, Amazon SQS, Amazon SNS, AWS CodePipeline, AWS CodeBuild, AWS CodeDeploy, and the AWS SDKs and CLI. The exam was updated in December 2024 (Version 2.1) to include 18 new skills, incorporating topics such as Amazon Q Developer, event-driven architecture patterns with Amazon EventBridge, and resilience patterns like retry logic and circuit breakers.
The certification covers four weighted domains: developing applications with AWS services (32%), implementing security controls (26%), automating deployment workflows (24%), and troubleshooting and optimizing applications (18%). It is recognized globally as a benchmark for cloud developers and is valid for three years, after which holders can recertify by retaking the current exam version or by earning the AWS Certified DevOps Engineer – Professional credential.
This certification is designed for software developers and cloud engineers who spend at least a portion of their role building and maintaining applications on AWS. Relevant job titles include Cloud Developer, Backend Developer, Full-Stack Developer, DevOps Engineer, and Solutions Developer. Candidates typically have one or more years of hands-on experience writing application code using AWS services, familiarity with at least one high-level programming language (such as Python, Java, JavaScript, or Go), and practical knowledge of cloud-native development patterns.
Developers who are new to cloud but hold strong general programming backgrounds will also find this exam accessible, though AWS recommends that individuals with no prior IT experience first earn the AWS Certified Cloud Practitioner to build foundational knowledge before attempting this associate-level exam.
There are no formal prerequisites required to register for the DVA-C02 exam. However, AWS recommends that candidates have one or more years of practical experience developing and maintaining applications using AWS services before sitting the exam. Candidates should be comfortable with at least one high-level programming language and have working knowledge of AWS core services such as IAM, S3, DynamoDB, Lambda, API Gateway, SQS, and SNS.
Familiarity with CI/CD concepts and hands-on experience with AWS developer tools (CodeCommit, CodeBuild, CodeDeploy, CodePipeline) is also strongly advised. Candidates should understand RESTful API design, serverless architectures, and basic cloud security principles including authentication via Amazon Cognito and secrets management via AWS Secrets Manager and AWS Systems Manager Parameter Store.
The DVA-C02 exam consists of 65 total questions: 50 scored questions and 15 unscored pretest questions that do not affect the final score (unscored questions are not identified during the exam). Question types are either multiple choice (one correct answer from four options) or multiple response (two or more correct answers from five or more options). The time limit is 130 minutes, and the exam is proctored via Pearson VUE either at an authorized testing center or through an online proctored session. The exam is available in English, Japanese, Korean, Portuguese (Brazil), Simplified Chinese, and Spanish (Latin America).
Scores are reported on a scaled score of 100–1,000, with a minimum passing score of 720. Unanswered questions are scored as incorrect; there is no penalty for guessing. The exam fee is $150 USD, and AWS provides certified holders with a 50% discount voucher for their next certification exam.
The AWS Certified Developer – Associate is one of the highest-compensating associate-level cloud certifications available. AWS-certified developers in the United States report average salaries of approximately $130,000–$133,000 per year, with senior roles exceeding $150,000. According to industry salary surveys, AWS-certified IT professionals earn on average 27.5% more than non-certified counterparts, and 19% of certification holders report a direct salary increase following certification. The credential is recognized globally and is frequently listed as a required or preferred qualification in cloud developer job postings across financial services, healthcare, technology, and e-commerce sectors.
Beyond compensation, 63% of certified AWS professionals report receiving or expecting a promotion after certification, and 41% report increased workplace engagement. The DVA-C02 serves as a natural step toward higher-level credentials including the AWS Certified DevOps Engineer – Professional and AWS Certified Solutions Architect – Professional. Compared to vendor-neutral developer certifications, the AWS Developer Associate carries stronger market specificity, particularly for organizations running workloads on AWS — which represents the majority of enterprise cloud deployments.
5 sample questions with correct answers and explanations. Start a practice session to test yourself across all 536 questions.
1. In a standard 3-tier web application architecture on AWS, where is the web server tier (e.g., EC2 instances running Apache or Nginx) typically placed?
Explanation
A key principle of the 3-tier architecture is to protect the application and data layers from direct public exposure. Why it's correct: The web/application servers do not need to be directly exposed to the internet. The best practice is to place the public-facing Elastic Load Balancer in public subnets. The ELB then forwards legitimate application traffic to the EC2 instances, which are safely located in private subnets. This reduces the attack surface of the application servers. Why others are incorrect: Placing instances in a public subnet is less secure. The data tier must be in the most protected private subnet. The web tier is part of the cloud application, not on-premises.
2. An IAM policy for a Cognito Identity Pool user needs to grant access to a user-specific prefix in an S3 bucket (e.g., s3://my-bucket/123-abc-456/*). How can the user's unique identity ID be dynamically inserted into the policy?
Explanation
Cognito policy variables allow for the creation of dynamic, fine-grained access control policies. Why it's correct: The ${cognito-identity.amazonaws.com:sub} policy variable is specifically designed for this. When the IAM policy is evaluated for a user, AWS automatically substitutes this variable with the user's unique Cognito identity ID. By using this in the Resource ARN's condition, you can create a single, powerful policy that restricts each user to their own folder within the S3 bucket. Why others are incorrect: Creating a policy per user is not scalable. ${aws:userid} refers to the IAM user's ID, not the Cognito identity. It is possible and a very common pattern.
3. The operations team at 'SecureBank' needs to be notified immediately via email and SMS if the CPUUtilization of their critical audit database (Amazon RDS) exceeds 80% for 5 consecutive minutes. Which components should be used to build this alert?
Explanation
This is a classic monitoring and alerting scenario. CloudWatch Alarms are designed to watch metrics and perform actions, while SNS is designed to deliver notifications to multiple endpoints. Why it's correct: You would create a CloudWatch Alarm based on the CPUUtilization metric for the specific RDS instance. The alarm would be configured to enter the ALARM state if the threshold (80%) is breached for 5 consecutive periods of 1 minute. The alarm's action would be to publish a message to an SNS topic. This SNS topic would then have two subscriptions: one for an email address and one for an SMS phone number, ensuring both are notified. Why others are incorrect: EventBridge is for reacting to events, not metric thresholds. A polling Lambda is inefficient and reinvents the functionality of CloudWatch Alarms. X-Ray is for tracing requests, not for threshold-based metric alerting.
4. An organization with a large team of Kubernetes experts wants to migrate their containerized applications to AWS. They want to continue using their existing Kubernetes tools and configurations (like kubectl and YAML manifests) with minimal changes. Which AWS container orchestration service should they choose?
Explanation
Amazon EKS is a managed container service to run and scale Kubernetes applications in the cloud or on-premises. Why it's correct: EKS provides a fully managed, certified Kubernetes control plane. This allows the team to leverage their existing Kubernetes skills and tools. They can point kubectl to the EKS cluster endpoint and deploy their existing Kubernetes manifests directly to AWS without needing to learn the ECS APIs or rewrite their configurations. Why others are incorrect: ECS uses a different API and orchestration model. Elastic Beanstalk is a higher-level PaaS that abstracts away the container orchestrator. Lightsail is for simpler workloads.
5. A CodePipeline running in the DevTools account (111111111111) needs to deploy an application to an EC2 fleet in the Production account (999999999999). How can CodePipeline be granted permission to perform actions in the Production account?
Explanation
Using cross-account IAM roles is the standard, secure pattern for allowing services in one account to interact with resources in another. Why it's correct: You create an IAM role in the Production account with policies that allow it to perform the necessary CodeDeploy actions. Critically, this role's trust policy must specify the ARN of the CodePipeline's execution role in the DevTools account. Then, in the pipeline definition, you specify this cross-account role's ARN for the deployment action. CodePipeline will then assume that role to get temporary credentials to operate in the Production account. Why others are incorrect: Using root keys is a critical security anti-pattern. A public S3 bucket is irrelevant and insecure. Pipelines routinely perform cross-account deployments.
One-time access to this exam