The short version
DVA-C03 has four domains: Development with AWS Services (30%), Security (26%), Testing and Deployment (22%), and Troubleshooting and Optimization (22%). These weightings are in AWS’s DVA-C03 exam guide, published October 27, 2026, and match AWS’s September 2026 announcement. Topic lists below come from that announcement plus the DVA-C02 exam guide, so check the DVA-C03 guide for the task list.
Domain 1: Development with AWS Services (30%)
What it covers. Writing code that uses AWS services, writing Lambda functions, and using data stores. The DVA-C02 guide groups this into application code, Lambda, and data stores. It names architectural patterns (event-driven, microservices, fanout), synchronous versus asynchronous calls, resilient code for third-party integrations (retries, circuit breakers), APIs, SDK calls, messaging, streaming, and EventBridge. AWS says DynamoDB skills were merged from four skills into one for DVA-C03, so expect fewer but broader DynamoDB questions.
In practice. You configure a Lambda function with memory, timeout, concurrency, environment variables, and a destination for failures. You choose a partition key that spreads load. You decide between a queue, a topic, and an event bus.
Typical traps.
- Mixing up SQS, SNS, and EventBridge. Ask whether work is pulled by consumers or pushed to subscribers.
- Choosing a scan where a query works.
- Forgetting that retries on a function can run code twice, so handlers need to be idempotent.
- Treating eventually consistent reads as current.
What to practice. Build a queue-triggered function with a dead-letter queue, a DynamoDB table with a conditional write, and a REST API with a mapping template.
Domain 2: Security (26%)
What it covers. Authentication and authorization (Cognito, IAM roles, tokens, federation), encryption with AWS KMS, certificates, and handling sensitive data and secrets. DVA-C03 adds a new task on AI security. AWS lists five skills: access management for AI services, data privacy controls, content filtering and prompt-injection protection, securing AI agent interactions, and protecting sensitive content in monitoring logs. AWS also merged 13 encryption and sensitive-data skills into 7 in one task.
In practice. You give a Lambda function the minimum permissions through its execution role. You encrypt a large file with a data key from KMS. You keep a database password out of environment variables in plain text. You limit what an AI model can say with a guardrail.
Typical traps.
- Mixing up Cognito user pools (sign-in) and identity pools (AWS credentials).
- Forgetting that cross-account KMS access needs both a key policy and an IAM policy.
- Picking a long-lived access key where a role is the right answer.
- Confusing encryption at rest with encryption in transit.
What to practice. Walk through envelope encryption with the CLI, assume a role, and read a Bedrock Guardrails configuration.
Domain 3: Testing and Deployment (22%)
What it covers. Preparing artifacts, testing in development environments, infrastructure as code, and CI/CD. AWS says testing skills were merged from 11 skills across two tasks into 5 skills in one task. Expect AWS SAM and CloudFormation, test events, API Gateway stages, Lambda aliases and versions, CodeBuild, CodeDeploy, CodePipeline, AWS AppConfig, and deployment strategies (blue/green, canary, linear, rolling). AI-assisted topics include generating tests and supporting CI/CD. Containers, built with ECR and run on ECS, EKS, or Fargate, are new.
In practice. You write a SAM template, run it locally, then promote it through pipeline stages. You choose a deployment configuration that limits the damage of a bad release and know how to roll back.
Typical traps.
- Mixing up canary (two steps) and linear (equal steps).
- Not knowing which settings live in a buildspec file and which in an AppSpec file.
- Forgetting that a stage variable or alias lets one function version serve different environments.
What to practice. Deploy a SAM application, add a pipeline, and trigger a deployment that rolls back.
Domain 4: Troubleshooting and Optimization (22%)
What it covers. Root cause analysis, instrumenting code, and tuning. AWS merged observability skills (8 to 5) and optimization skills (9 to 6). Expect CloudWatch Logs, Logs Insights queries, custom metrics (including embedded metric format), X-Ray annotations, health checks, alarms, concurrency, caching, and memory sizing.
In practice. A function is throttled, a message keeps failing, or latency climbs. You read the logs, find the pattern, and pick the fix.
Typical traps.
- Answering with a new service when a setting would do.
- Missing the symptom that points to throttling instead of a code bug.
- Confusing a metric filter with a Logs Insights query.
What to practice. Break your own application on purpose, then diagnose it with logs and traces.
More guides for DVA-C03
- DVA-C03 Exam Format, Scoring and Retakes
- Is the DVA-C03 Exam Hard?
- DVA-C03 Prerequisites and Skills Check
- DVA-C03 Renewal and Retakes Explained
- Is DVA-C03 Worth It? An Honest Look
- DVA-C03 Cheat Sheet: Key Facts to Review
- DVA-C03 vs SAP-C03: Which AWS Exam First?
Next step
Take the sample questions to spot your weak domain, then build the study plan around it. Our DVA-C03 practice tests report your score per domain after every attempt.
Frequently asked questions
Which domain should I study first?
Start with Development, since it carries the most weight and the other domains build on Lambda and data stores.
Do I need to memorize every API parameter?
No, but you should know the main operations, options, and error names for the services you use.
Are AI topics a big part of the exam?
AI-assisted development appears across all domains and AI security is a new task. AWS’s announcement does not give a separate weighting for them.