DVA-C03 Cheat Sheet: Key Facts to Review

The short version

This sheet is for the last days of preparation. It lists the exam facts, then the ideas that decide many questions, grouped by domain. It does not cover everything on the exam, and it is no substitute for the AWS exam guide or for hands-on practice. AWS published the detailed DVA-C03 exam guide on October 27, 2026, so check it for the task list.

Exam facts at a glance

Item	Fact (from AWS pages)
Level	Associate
Time	130 minutes
Questions	65 (50 scored, 15 unscored)
Question types	Multiple choice, multiple response
Passing score	720 on a scale of 100 to 1,000
Domains	Development 30%, Security 26%, Testing and Deployment 22%, Troubleshooting and Optimization 22%
Validity	3 years
Delivery starts	December 1, 2026

Details are on the exam format page.

Domain 1: Development with AWS Services (30%)

Key concepts

Lambda settings: memory (also sets CPU), timeout, concurrency, environment variables, layers, versions and aliases.
Failed asynchronous invocations go to a dead-letter queue or an on-failure destination.
DynamoDB: partition key spreads load, sort key orders items, a query reads one partition key, a scan reads everything.
API Gateway: REST versus HTTP APIs, stages, throttling, caching, integrations.

Confusable pairs

SQS is for consumers that pull messages. SNS pushes to many subscribers. EventBridge routes events by rule.
Kinesis Data Streams keeps records for replay by consumers. Amazon Data Firehose delivers data to a destination.
Standard queues give at-least-once delivery. FIFO queues give ordering and deduplication.
Strongly consistent reads give current data. Eventually consistent reads cost less and may lag.

Decision rules

Handlers that can run twice must be idempotent.
“Lowest operational overhead” usually points to a managed integration, not custom glue code.
A hot partition means a poor key choice, not a need for a bigger table.

Traps

Using a scan where a query will do.
Forgetting that visibility timeout must exceed processing time.
Retrying without backoff and jitter.

Domain 2: Security (26%)

Key concepts

Execution roles give Lambda its permissions. Prefer roles over long-lived access keys.
KMS: envelope encryption uses a data key to encrypt data and the KMS key to protect the data key.
Secrets Manager stores and can rotate secrets. Parameter Store holds configuration and simple secrets.
AI security (new task): access control for AI services, data privacy, content filtering, prompt-injection protection, agent interactions, sensitive data in logs. Guardrails in Amazon Bedrock filter content.

Confusable pairs

Cognito user pools handle sign-in and tokens. Identity pools hand out AWS credentials.
Key policy versus IAM policy: cross-account KMS access needs both sides to allow it.
Encryption at rest versus in transit.
AWS managed key versus customer managed key: only the second gives you control over policy and rotation settings.

Decision rules

If the scenario says “no credentials in code”, think roles, Secrets Manager or Parameter Store.
If it says “least privilege”, narrow the action and the resource.

Traps

Putting secrets in plain environment variables.
Allowing access in one account but not in the key policy.

Domain 3: Testing and Deployment (22%)

Key concepts

SAM extends CloudFormation for serverless apps. `sam build`, `sam local invoke` and `sam deploy` are the usual flow.
CodeBuild reads a buildspec file. CodeDeploy reads an AppSpec file. CodePipeline links the stages.
Lambda aliases can shift traffic between versions.
Containers: build and store images in Amazon ECR, run them with ECS, EKS or Fargate.

Confusable pairs

Canary shifts traffic in two steps. Linear shifts in equal steps at set intervals.
All-at-once is fast but risky. Blue/green keeps the old version for rollback.
Buildspec phases (install, build, post_build) versus AppSpec hooks.

Decision rules

“Roll back automatically” suggests alarms attached to the deployment.
“Different settings per environment” suggests stage variables, aliases or AppConfig.

Traps

Mixing up which file belongs to which service.
Testing only the happy path.

Domain 4: Troubleshooting and Optimization (22%)

Key concepts

CloudWatch Logs, metrics and alarms. Logs Insights queries logs on demand. Metric filters turn log patterns into metrics.
X-Ray traces requests across services. Annotations are indexed for search.
Embedded metric format writes custom metrics from log lines.
Throttling shows up as errors with a specific code, not as slow code.

Confusable pairs

Reserved concurrency limits and reserves a function’s share. Provisioned concurrency keeps instances warm.
Caching at API Gateway, CloudFront or ElastiCache, each fits a different layer.

Decision rules

Cold start pain: consider provisioned concurrency or SnapStart where it applies.
Slow database reads: cache, then consider indexes.

Traps

Adding a new service when a setting solves the problem.
Reading an average when the problem sits in the tail.

Last-day checklist

Review your wrong answers from the last two practice sets, not new material.
Rehearse the confusable pairs above out loud.
Read the current AWS exam guide once, for the task list.
Check your ID and booking details, and your exam-day setup. See the exam day guide.
Sleep. Do not start a new topic tonight.

More guides for DVA-C03

Next step

Use the domains explained page for the detail behind each block, and the sample questions for a quick check. Back to the exam overview. For timed practice, try the DVA-C03 practice tests.

Frequently asked questions

Can I pass using only a cheat sheet?

No. A sheet helps you recall. You still need hands-on practice and enough practice questions.

Does this cover the whole exam?

No. It lists high-value ideas, and the AWS exam guide defines the full scope.

Try these practice exams