CertiOverview
Exam format, the 720 passing score, domain weights, and a study plan.
Study guide · Core notes
Developer Notes: ship the call that fits
Reference notes for DVA-C02: how the code talks to AWS, who may call it, how the artifact is released, and which signal names the failure.
How to read these notes: Items tagged Extra sit outside the scored DVA-C02 exam, including designing a VPC or a pipeline from scratch and the emerging AI topics version 2.1 says do not affect your score. Learn the unmarked items first. New to the exam? Start with the overview for the format and the 720 passing score. Foundational service names are in the Cloud Practitioner notes.
Module 1: Patterns, APIs, and messaging
Domain 1 starts with the shape of the call. Synchronous means the caller waits. Asynchronous means the work is accepted and finished later. Stateful means the process remembers the user between calls. Stateless means any copy of the process can handle the next request because the state lives in a store. Tight coupling means one component cannot change without the other. Loose coupling puts a queue, a topic, or an event between them.
| Tool | Use it when | It does not |
|---|---|---|
| Amazon SQS | A producer should leave work for a consumer to pull. A visibility timeout hides a message while it is being processed. A dead-letter queue catches messages that fail too many times. | Push the same message to many subscribers. That fan-out is SNS. |
| Amazon SNS | One publish must reach many subscribers, optionally through a filter policy so a subscriber skips messages it does not care about. | Store the message until a worker is free. Put SQS on the subscription when you need that buffer. |
| Amazon EventBridge | Services should react to an event pattern, or a schedule should start work, without one component calling the next by name. | Replace a queue that must preserve a backlog for a single consumer. |
| AWS Step Functions | You own the order of steps, with retries and a catch. That is orchestration. | Make every service subscribe to every event. Independent reactions are choreography, usually with EventBridge. |
| Amazon API Gateway | HTTP clients need a front door, with stages, throttling, authorizers, and a Lambda proxy or another integration. | Replace the function’s business logic. The stage is a deployment of the API, not a second copy of the code by itself. |
| Amazon Kinesis Data Firehose | A stream should be buffered and delivered to a destination such as Amazon S3. Amazon Kinesis is in scope for streaming. | Keep a consumer-readable log you can rewind. That replay path is Amazon Kinesis Data Streams. |
Retry a third-party call with backoff and jitter, and stop when a circuit breaker opens. An immediate retry storm makes an outage worse. Make the write idempotent when the same request can arrive twice, which queues and async Lambda invocations do. Amazon Q Developer is the in-scope assistant in version 2.1 for generating, reviewing, and completing code. You still own the API contract, the validation, and the status codes the client sees.
Module 2: AWS Lambda
Configure the function for the event, the limit, and the failure path.
A function has a runtime, a handler, memory, a timeout, and an execution role. Memory runs from 128 MB to 10,240 MB, and CPU moves with memory. The timeout ceiling is 15 minutes. Ephemeral storage at /tmp starts at 512 MB and can be raised to 10,240 MB. Environment variables are configuration. Encrypt them with a KMS key when they hold a secret, and prefer Secrets Manager when the value must rotate.
Synchronous invocation waits for the response. Asynchronous invocation retries twice by default and can send the outcome to a destination such as SQS, SNS, Lambda, or EventBridge. A dead-letter queue is the older failure sink for async invocations. Destinations can report both success and failure. Event source mappings poll SQS, Kinesis, and DynamoDB Streams. For SQS, report partial batch failures so one bad record does not return the whole batch.
A layer shares libraries across functions. An extension runs beside the runtime. An alias points at a version, and a weighted alias splits traffic for a canary. Reserved concurrency caps how many copies of that function run and holds that amount out of the account pool. Zero reserved concurrency stops the function. Provisioned concurrency keeps environments initialized so cold starts are less likely. It does not raise the memory setting.
To reach a private resource, attach the function to subnets and a security group. Traffic to public AWS APIs or the internet then needs a VPC endpoint or a NAT gateway. A function inside a VPC is not automatically on the public internet. Amazon RDS Proxy, or a similar pool, belongs in front of a database when many concurrent invocations would open too many connections.
Module 3: Data stores in application code
Pick the store from the access pattern. DynamoDB fits a known key. A high-cardinality partition key spreads traffic. A low-cardinality key, such as a Boolean status, creates a hot partition. A sort key supports a range on that partition. Query uses a key condition. Scan reads widely and then filters, so it is the expensive way to answer a key lookup. Strongly consistent reads see the latest write in that table’s Region. Eventually consistent reads are the default and can be slightly behind. A global secondary index can use a different partition key and does not support strongly consistent reads. A local secondary index shares the table’s partition key and must be created with the table.
Serialize the object your SDK expects, and do not invent a second format between the writer and the reader. Conditional writes stop two clients from overwriting the same item. TTL expires items eventually. It is not a precise clock and it is not a backup. DAX caches DynamoDB reads. ElastiCache is a Redis or Memcached cache the application addresses itself. Amazon OpenSearch Service fits search and other access patterns a key-value table does not. Amazon RDS and Aurora fit relational transactions. Aurora Serverless is still a relational engine. It does not turn the workload into a key lookup.
S3 fits objects. A presigned URL grants temporary access without making the object public. Lifecycle rules age objects. They do not change who may call the API. Multi-tenant data needs a tenant boundary in the key or in the authorization check, so one customer’s query cannot scan another customer’s items.
Module 4: Authentication and authorization
A Cognito user pool authenticates people and issues tokens. The application sends that token as a bearer credential. An identity pool exchanges a trusted token for temporary AWS credentials. Do not swap those two jobs. API Gateway can check the token with a Cognito authorizer, a Lambda authorizer, or IAM authentication.
Application code on Lambda, ECS, or EC2 should assume an IAM role. STS returns temporary credentials. A long-term access key in a repository, an image, or a plain environment variable is the failure mode. The execution role needs the API calls that function makes, and nothing broader. Resource policies and identity policies both have to allow a cross-account call. Application-level authorization, such as a claim in the token that names the tenant, is how you keep one user inside one slice of data after IAM has allowed the API.
Extra Creating IAM users and groups, and designing the VPC, are outside the developer task list. Using a role and a security group on the function is in scope. Reaching a private resource from Lambda means attaching the function to the VPC.
Module 5: Encryption, secrets, and masking
Decide where the ciphertext is produced, then where the secret is stored.
Encryption in transit is TLS. Encryption at rest protects stored bytes. Client-side encryption happens in the application before the bytes reach AWS, which matters when the requirement is that AWS stores ciphertext the client produced. Server-side encryption happens after AWS receives the data. SSE-S3, SSE-KMS, and SSE-C answer different questions about who owns the key. A customer managed KMS key can rotate on a schedule you enable. Cross-account decrypt needs both the key policy and the caller’s IAM policy.
Secrets Manager stores a secret and can rotate it. Read it at runtime. Do not bake it into a container image or a deployment package. Systems Manager Parameter Store can hold configuration, including a SecureString. The rotation workflow the exam guide points at is Secrets Manager. Mask or sanitize sensitive fields before they reach a response or a log. Classification labels such as PII and PHI tell you which fields need that treatment. A multi-tenant pattern that only filters in the user interface still returns the other tenant’s row to anyone who calls the API directly.
AWS Private CA is the certificate example named in the DVA-C02 skill list when you need a private certificate authority. A public certificate on an API custom domain is a separate attachment. Do not confuse a certificate with a KMS data key.
Module 6: Emerging topics, unscored
Extra Version 2.1 says you might see pretest questions on emerging AI topics, and those questions do not affect the DVA-C02 score. The list includes broader AI-assisted development, security risks of integrating AI services, generated tests beyond the Amazon Q Developer skill, AI help in CI/CD, and AI troubleshooting or optimization suggestions.
Amazon Q Developer is different. Skills 1.1.11 and 3.3.6 put it in the scored outline for development help and generated tests. A draft still needs your review: the right API call, no secret in the log, and an assertion that checks real behavior.
CodeGuru and AWS Copilot were removed from the in-scope list in version 2.1. Do not treat them as the current answer when the stem asks for the in-scope assistant or a deployment tool the guide still names.
Module 7: Artifacts, tests, and deployment
One package, more than one environment, and a way back.
| Need | Use | Watch for |
|---|---|---|
| Serverless package | AWS SAM, CloudFormation, or the AWS CDK | SAM local and a test event exercise the function before a shared environment. Deploy the same template to the next stage. |
| Configuration without a new build | AWS AppConfig | Feature flags and environment settings change without a redeploy. A secret that rotates still belongs in Secrets Manager. |
| Container image | Amazon ECR, then ECS, EKS, or Fargate | Set memory, CPU, and a readiness check on the task. Fargate removes the EC2 instances. EKS is managed Kubernetes. Lambda can also run a container image. |
| Build and release | CodeBuild, CodePipeline, and CodeDeploy | A commit starts the pipeline. CodeBuild compiles and tests. CodeDeploy shifts traffic. CodeArtifact holds packages. Extra Designing the pipeline from scratch is outside the task list. Using an existing pipeline, including its approval action, is in scope. |
| API environments | API Gateway stages and stage variables | Test against the stage that matches the environment. A custom domain points at a stage. It does not create the business logic. |
| Safe cutover | Canary, linear, rolling, or blue/green | Canary and linear start with a slice. Rolling replaces instances in batches. Blue/green keeps the old environment so a rollback is a traffic shift. Lambda aliases and CodeDeploy both express these strategies. |
Write unit tests where you develop, and integration tests with mocks for dependencies you do not own. Amazon Q Developer can generate those tests. A generated test still has to assert the behavior you care about. AWS Amplify branches and Lambda aliases are ways to pin an environment to a known revision. Elastic Beanstalk fits an application you upload when you want the platform to handle capacity. Its deployment policies include all-at-once, rolling, immutable, and traffic swap. Immutable and blue/green are the ones that leave the old copy running until you decide.
Roll back by moving the alias, rerunning the previous deployment, or shifting the load balancer back. Editing the live function in the console and hoping is not a strategy. Health checks and readiness probes must pass before traffic moves, or a canary only proves that broken tasks can receive users.
Module 8: Troubleshooting and optimization
Logging records what happened. Metrics are numbers over time. Tracing follows one request across services. CloudWatch Logs holds the application output. Logs Insights searches it. Embedded metric format puts a metric inside a structured log so you do not call PutMetricData for every point. X-Ray annotations are indexed and can be filtered. Metadata is stored and is not the filter key. CloudTrail records AWS API calls, which helps when a deployment or a permission changed underneath the code. A dashboard shows health. An alarm notifies on a quota, an error rate, or a finished deployment, often through SNS.
When a release fails, read the service output first: CodeBuild logs, CodeDeploy hook output, or CloudFormation events. When one request is slow, open its trace before you change the instance size. A timeout that always happens at the same downstream call is that dependency, not a random cold start.
Optimization follows the measurement. Raise Lambda memory when the function is CPU-bound, because CPU scales with memory. Set reserved concurrency when one function must not consume the account pool, and provisioned concurrency when cold starts break the latency budget. Cache a repeated read in ElastiCache, DAX, or API Gateway, and include the right headers in a CloudFront cache key when the response varies by header. An SNS filter policy drops work the subscriber should never see. A DynamoDB scan in a hot path is usually the wrong fix. Change it to a query on the key you actually have.
Confirm a guess against the log line, the metric, and the trace before you ship the change. Do not paste a secret from those logs into another tool.
Frequently asked questions
When do you use an IAM role instead of an access key in application code?
Use an IAM role when the code runs on AWS and can receive temporary credentials from STS. A long-term access key in source code, an image, or a Lambda environment variable does not expire on its own.
When do you choose Amazon SQS instead of Amazon SNS?
Choose SQS when one consumer should pull work later. Choose SNS when one publish must reach many subscribers. EventBridge matches events to rules. Step Functions orders a workflow.
What should you do with a sensitive value before it reaches a log?
Mask or remove it. Version 2.1 includes sanitizing sensitive data in application code. Broader AI topics in that guide are emerging pretest items and do not affect the DVA-C02 score.
Service names change. Use the current AWS exam guide as the authority when it differs from these notes. These notes follow DVA-C02 exam guide version 2.1.
Continue the AWS Developer study path
Drill the facts, then test them under a timer.
Core Notes
Reference notes for services, security, deployment, and troubleshooting.
Flashcards & Memory Notes
40 recall cards in four decks, plus memory notes for messaging, credentials, and traces.
Practice Exams
200 original questions with custom exams, explanations, and a score report by domain.
Related Tools
Useful companions while you study.
JSON YAML Converter
Convert structured data between JSON and YAML with formatting and validation.
Base64 Converter
Encode text and files to Base64 or decode Base64 data with UTF-8 support.
Diff Checker
Compare two text blocks and highlight added, removed, and changed content.
CSV JSON Converter
Convert CSV spreadsheet data to JSON or turn JSON arrays into downloadable CSV files.
Legal Disclaimer
Certicab provides general informational, educational, and convenience resources. Calculations, conversions, estimates, and learning materials may contain errors or become outdated. Financial, tax, medical, legal, and travel information is not professional advice. Verify important results and current requirements with qualified professionals or authoritative sources. Protect sensitive files and personal information, review each tool’s privacy limitations, and use only content you are authorized to process. You are responsible for how you use and share results. Study resources are independent and do not guarantee exam success or imply certification-provider endorsement. Amazon Web Services, AWS, and related marks are trademarks of Amazon.com, Inc. or its affiliates. Certicab is not affiliated with, endorsed by, or sponsored by Amazon.