AWS Developer Associate — Development and Security flashcards
10 of 79 cards free to study here · 2 topics · the whole deck is built into Willys
Code-level scenarios on Lambda invocation, concurrency, layers and failure handling, DynamoDB keys, indexes and conditional writes, API Gateway, SQS, SNS, EventBridge, Step Functions and S3 SDK patterns, then IAM for code, Cognito, KMS envelope encryption and secrets.
Learn deck · part of AWS Certified Developer – Associate · written against: Exam DVA-C02 guide. Updated 2026-10-10.
Study the free sample
10 cards from the deck as they are. Flip, rate yourself, filter by topic; your progress stays in this browser.
Tap the card or press Space to flip
The 10 sample cards as a list
-
An API Gateway request, an S3 upload notification and an SNS message each trigger a Lambda function. Which of these calls are synchronous and which are asynchronous?API Gateway invokes the function synchronously — the caller waits for the result. S3 and SNS invoke it asynchronously: Lambda queues the event, answers at once and runs the function afterwards, retrying on failure.Development with AWS Services › Lambda
-
How does Lambda get records out of an SQS queue, a Kinesis stream or a DynamoDB stream, given that none of them pushes to Lambda?Through an event source mapping: a poller managed by Lambda reads batches from the source and invokes the function synchronously with each batch.Development with AWS Services › Lambda
Watch out: the function's execution role needs permission to read the source, because Lambda polls with it. -
An asynchronously invoked function throws an error. What does Lambda do with the event before it gives up?It retries the event on its own (by default two more attempts, spaced out), then drops it or hands it to a configured on-failure destination or dead-letter queue. Both the retry count and the maximum event age can be tuned.Development with AWS Services › Lambda
-
How does a Lambda on-failure destination differ from a dead-letter queue for asynchronous invocations?A dead-letter queue (SQS or SNS) gets only the original event. A destination (such as SQS, SNS, another function or an EventBridge bus) gets an invocation record with the request, the response or error and metadata, and destinations also offer an on-success route.Development with AWS Services › Lambda
-
One malformed message in an SQS batch makes the function fail, so every message in the batch is redelivered again and again. How do you stop reprocessing the good ones?Turn on partial batch responses (Development with AWS Services › Lambda
ReportBatchItemFailures) and have the handler return only the failed message IDs; Lambda deletes the rest. Add a redrive policy on the queue so a message that keeps failing moves to a DLQ. -
When application code calls the SDK with no keys configured, where does the SDK look for credentials?Along the default credential provider chain: environment variables, the shared credentials and config files, then the container or instance role endpoint. On Lambda, the execution role's temporary credentials arrive through environment variables.Security › IAM for Application Code
-
What is a Lambda execution role, and how does the function obtain its credentials?An IAM role whose trust policy lets the Lambda service assume it; Lambda assumes the role on the function's behalf and hands the code temporary credentials for its AWS calls.Security › IAM for Application Code
-
A new function runs, but nothing ever appears in CloudWatch Logs. Which permission is most likely missing?The execution role lacks CloudWatch Logs permissions (create log group and stream, put log events) — the basic execution managed policy grants exactly these.Security › IAM for Application Code
-
S3 must be allowed to invoke a function. Do you add that permission to the function's execution role?No — the execution role controls what the function may call. Permission for S3 to invoke the function goes in the function's resource-based policy (for example withSecurity › IAM for Application Code
aws lambda add-permission). -
A role has a trust policy and a permissions policy. What does each control?The trust policy says who may assume the role (the principal allowed sts:AssumeRole). The permissions policy says what the role's sessions may do once assumed.Security › IAM for Application Code
Unlock the whole deck
You are studying a free 10-card sample. All 79 cards of AWS Developer Associate — Development and Security, the other 2 AWS Certified Developer – Associate decks, and spaced-repetition scheduling are built into Willys. 14-day free trial, then $14.99 a year.
In Willys, tap Exam Library at the top of your Decks (or Browse Exam Library… under the + button), find the exam on its shelf or by search, tick it and tap Add.
More AWS Certified Developer – Associate decks
← All AWS Certified Developer – Associate decks, with the study guide and topic outline.
About these cards
Review status: Second-reader reviewed, with corrections applied.
Checked against:
- AWS Certified Developer – Associate DVA-C02 exam guide — topic outline only; no text copied
These are independent study notes written for Willys. They are not official exam material, may contain mistakes, and are no substitute for your course, your teacher or the exam owner's own publications. Found an error? Tell us — corrections ship as a new version of the deck.
Amazon Web Services, AWS and AWS Certified are trademarks of Amazon.com, Inc. or its affiliates. This product is not affiliated with, sponsored by, or endorsed by Amazon Web Services.
Use of these pages is covered by our Terms of Use.