AWS Certified Developer - Associate (DVA-C02) practice questions

A developer is building an order service that publishes an OrderPlaced event. Three independent consumers must each receive every event: an email service polls a queue, an analytics service polls a separate queue, and an inventory service is an HTTP endpoint. The developer wants each consumer to process events at its own pace with retry and buffering. Which design implements this fan-out most directly?

• APublish each event to an SNS topic and subscribe the two queues plus the inventory HTTP endpoint to the topic so SNS delivers a copy to every subscriber.check_circle Correct
• BPublish each event to one SQS standard queue and let all three consumers poll that single shared queue so every service receives the same message body.
• CPublish each event to an SNS topic with the inventory HTTP endpoint subscribed directly and the two services reading from the topic by long polling it for messages.
• DPublish each event to an SQS FIFO queue and configure three message group IDs so each consumer reads only the group that matches its own service name reliably.

Why A is correct: SNS fan-out pushes a copy of each message to every subscriber, so both queues buffer for their pollers and the HTTP endpoint receives a direct delivery with retries.

Why B is wrong: A single SQS queue delivers each message to only one consumer that deletes it, so the three services would compete for messages rather than each receiving every event.

Why C is wrong: SNS is push-based and cannot be polled, so subscribing the services by polling the topic is not possible and would lose the buffering the queues provide.

Why D is wrong: Message group IDs order messages within a single FIFO queue but still deliver each message once, so they cannot duplicate every event to three separate consumers.

An iOS application authenticates users through an Amazon Cognito user pool and now needs each signed-in user to upload files straight to an Amazon S3 bucket from the device using the AWS SDK, scoped by an IAM role. The team does not want to embed any long-lived AWS access keys in the app. Which approach lets the device obtain temporary AWS credentials for these S3 calls?

• AConfigure an Amazon Cognito identity pool that trusts the user pool, then exchange the user pool token for temporary AWS credentials from an assumed IAM role.check_circle Correct
• BPass the user pool ID token directly to the AWS SDK for Amazon S3, because the SDK accepts a Cognito JWT as the signing credential for S3 requests.
• CCreate an IAM user for the bucket and ship its access key and secret key inside the application bundle so the SDK can authorise each upload.
• DAttach a bucket policy that grants the user pool group access, so any token issued by the user pool can call Amazon S3 without further credential exchange.

Why A is correct: An identity pool trusts the user pool as an authentication provider and calls STS to return short-lived role credentials, which the SDK uses to sign the S3 requests with no stored keys.

Why B is wrong: The AWS SDK signs S3 requests with SigV4 access keys, not a raw JWT, so a user pool ID token cannot be used directly as the S3 signing credential.

Why C is wrong: Embedding a long-lived IAM access key in a distributed app exposes the secret to extraction and never rotates, which the requirement and least-privilege practice both forbid.

Why D is wrong: An S3 bucket policy authorises IAM principals, not user pool tokens, so it cannot let a Cognito JWT call S3 and does not produce the temporary credentials the SDK needs.

A developer is building a mobile application that must let end users sign up, sign in with email and password, and reset forgotten passwords, all managed by AWS without running a custom user database. After sign-in the application calls a backend REST API but does not yet need to call AWS service APIs directly. Which Amazon Cognito component should the developer use for this sign-up and sign-in requirement?

• AAn Amazon Cognito identity pool, because it provides the hosted sign-up and sign-in screens and stores each user profile and password for the mobile application.
• BAn AWS Identity and Access Management user for each application user, because IAM manages credentials and password resets centrally for any kind of human sign-in.
• CAn Amazon Cognito identity pool federated to social providers, because it authenticates the email and password and then returns session tokens to the application.
• DAn Amazon Cognito user pool, because it is a managed user directory that handles sign-up, sign-in, and password reset and issues tokens after authentication.check_circle Correct

Why A is wrong: An identity pool exchanges an existing identity for AWS credentials and does not store user profiles or passwords, so it cannot provide the sign-up and sign-in directory the application needs.

Why B is wrong: IAM users are meant for workforce and service access, not large fluctuating end-user populations, and AWS advises against creating an IAM user per application user for sign-in.

Why C is wrong: An identity pool federates already authenticated identities and never validates an email and password itself, so it cannot perform the primary sign-in that the application requires.

Why D is correct: A Cognito user pool is a fully managed directory that performs sign-up, sign-in, and password recovery and returns ID and access tokens, which matches the stated requirement exactly.