About these questions
These five questions are original. We wrote them in the style of the DVA-C03 skills, with the domains in rough proportion to their weight. They are not exam questions, and the actual exam will word things differently. One question tests the new AI security topic from AWS’s September 2026 announcement.
How to use these
Try each question without looking at your notes, and pick an answer before you open the explanation. Then read the explanation even when you were right, because the reason the closest wrong option fails is where the learning is. Note any domain where you slipped and revisit it in the domains explained page.
Question 1 (Development with AWS Services)
A ticketing app keeps one item per reserved seat in a DynamoDB table, with seatId as the partition key. When two buyers reserve seat A12 at the same moment, the second PutItem silently replaces the first buyer’s reservation. How should the developer prevent this?
- A. Use PutItem with a condition expression of attribute_not_exists(seatId)
- B. Call GetItem with a strongly consistent read first, and write only when no item comes back
- C. Turn on DynamoDB Streams and undo the later write when a duplicate appears
- D. Add a global secondary index on buyerId
Show the answer and explanation
Correct answer: A. DynamoDB evaluates a condition expression as part of the write itself, so the check and the write happen atomically. If seat A12 already exists, the second request fails with a ConditionalCheckFailedException and nothing is overwritten. Option B is the closest wrong answer. A strongly consistent read shows the latest data, but another buyer can still write between your read and your write. Streams only report changes after they happen, and an index on buyerId does not change how a write to the seat key behaves.
Question 2 (Security)
A secret in account A is encrypted with a customer managed AWS KMS key in account A. A resource policy on the secret already allows a role in account B to call GetSecretValue. The role still receives an access denied error that mentions the KMS key. Which two changes fix this? Choose two.
- A. Add a statement to the key policy in account A that allows the account B role to use kms:Decrypt
- B. Turn on automatic key rotation for the key
- C. Re-encrypt the secret with the AWS managed key aws/secretsmanager
- D. Attach an IAM policy to the account B role that allows kms:Decrypt on the key’s ARN
- E. Create a key alias in account B that points to the key
Show the answer and explanation
Correct answers: A and D. Cross-account use of a KMS key needs permission on both sides. The key policy in the owning account must allow the outside principal, and the outside account must also grant that permission to the role through an IAM policy that names the key ARN. Option C is the closest wrong answer. AWS managed keys cannot be shared across accounts because you cannot edit their key policy, so switching to one would remove the option, not add it. Rotation changes key material and has no effect on permissions, and an alias in account B cannot point at a key in account A.
Question 3 (Security)
A pharmacy chain builds a customer chatbot on Amazon Bedrock. The chatbot may explain store hours and refill steps, but it must refuse questions about dosage changes for prescription drugs, even when users phrase them indirectly. The team wants a managed control and no custom classification code. Which Amazon Bedrock Guardrails feature fits best?
- A. A word filter that lists common drug names
- B. A denied topic that describes dosage advice for prescription drugs, with sample phrases
- C. A sensitive information filter that masks patient identifiers
- D. Content filters set to the highest strength for every category
Show the answer and explanation
Correct answer: B. A denied topic lets you describe a subject in plain language and give example phrases. The guardrail then blocks prompts and responses about that subject, including indirect wording. A word filter, the closest wrong option, only matches exact terms. It would miss paraphrases and also block harmless questions that happen to mention a drug name. The sensitive information filter protects personal data, not a subject area. Content filters target harm categories such as hate or violence, so dosage advice would pass through.
Question 4 (Testing and Deployment)
A team ships a new version of a Lambda function with AWS CodeDeploy. They want 10 percent of traffic to reach the new version first, then a 15-minute wait while alarms are watched. If the alarms stay quiet, the remaining 90 percent should move over in one step. Which deployment configuration type fits?
- A. Linear
- B. Canary
- C. All-at-once
- D. Provisioned concurrency
Show the answer and explanation
Correct answer: B. A canary configuration shifts traffic in two steps: a small share first, then the rest after a set interval. A predefined option such as Canary10Percent15Minutes matches this scenario. Linear is the closest wrong answer. It moves traffic in many equal increments at regular intervals until it reaches 100 percent, rather than jumping from the first step to the rest. All-at-once sends all traffic immediately. Provisioned concurrency keeps function instances warm, so it is a performance setting and not a traffic-shifting strategy.
Question 5 (Troubleshooting and Optimization)
A Step Functions task calls a shipping-rate API. The error RateLimited is temporary and usually succeeds on a later attempt. The error InvalidAddress is permanent and must send the order to a state that notifies the customer. The team wants the state machine to handle both without custom error-handling code. How should the task be configured?
- A. A Retry with backoff for States.ALL, so every error is tried again
- B. A Catch for States.ALL that sends every error to the notification state
- C. A Retry with backoff for RateLimited and a Catch for InvalidAddress that leads to the notification state
- D. A wrapper Lambda function that catches errors, waits, and retries the API call itself
Show the answer and explanation
Correct answer: C. Retry handles temporary failures: you name the error, set an interval, a maximum number of attempts, and a backoff rate. Catch routes a permanent error to another state once retries make no sense. Option A is the closest wrong answer. It would retry InvalidAddress several times, which wastes time and never fixes a bad address. Option B would notify customers about temporary rate limits that a retry would have solved. Option D adds custom code for something Step Functions already does natively.
More guides for DVA-C03
- DVA-C03 Study Plan: 4-Week and 8-Week
- Is the DVA-C03 Exam Hard?
- DVA-C03 Prerequisites and Skills Check
- DVA-C03 Renewal and Retakes Explained
- Is DVA-C03 Worth It? An Honest Look
- DVA-C03 Cheat Sheet: Key Facts to Review
- DVA-C03 vs SAP-C03: Which AWS Exam First?
Next step
If these felt comfortable, check the exam format and book once your practice scores are steady. If a domain felt shaky, try more questions in the DVA-C03 practice tests.