AWS Certified Developer – Associate Practice Test
Frequently asked questions
How many AWS Certified Developer – Associate practice questions are here?+
A full bank of original AWS Certified Developer – Associate practice questions across the official content areas, weighted like the real exam, with explanations. Free, no signup.
What is the AWS Certified Developer – Associate exam like?+
A multiple-choice exam, 130 minutes, and you need 720 / 1000% to pass. Practice by topic here, then take the full timed mock exam to gauge readiness.
Are these the real exam questions?+
No. Every question is 100% original, written from public primary sources with explanations. We never copy real exam questions or paid prep material.
Can I study in Chinese or Spanish?+
PrepPass practice is in English, 中文 and Español. The official exam is in English — switch the question language to English any time to rehearse the exact terminology you'll see on test day.
Sample practice questions
A few real questions from this free bank, with full explanations. Use the practice tool above for the whole set.
- 1. Development with AWS Services
A developer wants a Lambda function to reuse a database connection across invocations to reduce latency. Where should the connection be created?
- a.Inside the handler on every invocation
- b.Outside the handler, in the initialization code that runs once per execution environment
- c.In a separate Lambda layer that cannot run code
- d.In an environment variable
Answer: b
Explanation: Code outside the handler runs once when the execution environment initializes and is reused across warm invocations, so creating the connection there avoids re-establishing it on every call. Creating it inside the handler would open a new connection each invocation. Layers package dependencies but do not execute standalone, and environment variables hold configuration, not live connections.
- 2. Development with AWS Services
An application built on a FIFO SQS queue must ensure the same message is not processed twice when producers retry. Which feature prevents duplicates?
- a.Content-based or explicit message deduplication IDs on the FIFO queue
- b.Increasing the visibility timeout
- c.Enabling long polling
- d.Adding a dead-letter queue
Answer: a
Explanation: FIFO queues use a message deduplication ID (supplied explicitly or derived from content) to discard duplicate sends within a five-minute window, guaranteeing exactly-once processing. Visibility timeout and long polling affect delivery timing, not duplicate detection, and a dead-letter queue only captures repeatedly failing messages.
- 3. Development with AWS Services
When calling AWS services from code running on an EC2 instance, what is the recommended way for the AWS SDK to obtain credentials?
- a.Hard-code access keys in the source
- b.Rely on the default credential provider chain, which uses the instance's IAM role
- c.Prompt the user to paste keys at startup
- d.Store keys in a public S3 bucket
Answer: b
Explanation: The default credential provider chain automatically retrieves temporary, rotated credentials from the instance profile (IAM role) via the instance metadata service, so no long-lived keys are stored. Hard-coding or prompting for keys is insecure, and storing keys in a public bucket exposes them.
- 4. Security
A developer wants every use of an encryption key to be auditable in CloudTrail and to control the key's rotation policy. Which S3 encryption option meets this?
- a.SSE-KMS with a customer managed key
- b.SSE-S3 with Amazon S3 managed keys
- c.No encryption with a restrictive bucket policy
- d.Client-side encryption with a static hard-coded key
Answer: a
Explanation: A customer managed KMS key lets you set rotation and key policies and logs each encrypt/decrypt call in CloudTrail. SSE-S3 encrypts data but exposes no control or visibility over the key. A bucket policy does not encrypt data, and a hard-coded static key is insecure and unauditable.
- 5. Security
How should a developer protect data in transit between a client and an API hosted on API Gateway?
- a.Disable encryption to reduce latency
- b.Use a self-signed certificate over HTTP
- c.Rely on security groups only
- d.Require HTTPS/TLS so traffic is encrypted end to end
Answer: d
Explanation: Requiring HTTPS/TLS encrypts data in transit and is the standard for protecting API traffic; API Gateway endpoints use TLS by default. Disabling encryption or using plain HTTP exposes data, and security groups control network reachability, not encryption of the payload.
- 6. Deployment
Which file tells AWS CodeBuild the commands to run in each build phase and which artifacts to output?
- a.buildspec.yml
- b.appspec.yml
- c.Dockerfile
- d.template.yaml
Answer: a
Explanation: CodeBuild reads buildspec.yml to run install, pre_build, build, and post_build phases and to declare output artifacts. appspec is used by CodeDeploy, a Dockerfile builds container images, and template.yaml is a SAM/CloudFormation template.
- 7. Deployment
Why should Lambda deployments use published versions with an alias rather than always deploying to $LATEST?
- a.$LATEST runs faster
- b.Aliases reduce cold starts
- c.Versions cost less to invoke
- d.Immutable versions let you point a stable alias and roll back instantly by moving it
Answer: d
Explanation: Published versions are immutable snapshots; an alias points to a version, so rolling back is as simple as moving the alias to a previous version. This gives predictable releases and fast rollback. Aliases and versions do not change execution speed, cold starts, or invocation cost.
- 8. Troubleshooting and Optimization
An application repeatedly receives ProvisionedThroughputExceededException from DynamoDB during traffic spikes. Which is an appropriate first response in code?
- a.Implement exponential backoff with jitter on retries
- b.Delete and recreate the table
- c.Switch to a Scan instead of a Query
- d.Disable encryption on the table
Answer: a
Explanation: The exception signals throttling; retrying with exponential backoff and jitter (which the SDK does by default) smooths spikes, and switching to on-demand or higher provisioned capacity helps for sustained load. Recreating the table, using a costlier Scan, or disabling encryption do not address throttling.
- 9. Troubleshooting and Optimization
To make Lambda logs easy to query for specific fields in CloudWatch Logs Insights, what should the developer do?
- a.Log everything as a single long string
- b.Disable logging to save cost
- c.Log only error messages
- d.Emit structured JSON log entries with consistent field names
Answer: d
Explanation: Structured JSON logs let CloudWatch Logs Insights parse and filter by field, making troubleshooting far easier. Unstructured strings are hard to query, disabling logging removes visibility, and logging only errors hides the context needed to diagnose issues.
- 10. Data Stores and APIs
A developer must query a DynamoDB table by an attribute that is not the primary key. What should they create?
- a.A DynamoDB Stream
- b.A second table copied nightly
- c.A global secondary index on that attribute
- d.A CloudFront distribution
Answer: c
Explanation: A global secondary index lets you query on a non-key attribute efficiently. Streams emit change events, a nightly copy would be stale and costly, and CloudFront is a content delivery network unrelated to querying items.