AWS Certified Developer - Associate

DVA reads at the code level, not the architecture level. Expect questions that include actual SDK calls (`PutItem`, `GenerateDataKey`, `AssumeRole`), CLI commands (`aws lambda update-function-configuration`), or response shapes. The right answer is often the one that gets the SDK / API call exactly right; an architecturally-correct option that calls the wrong API will lose.

Lambda is the single most-tested service. Memorize the concurrency model cold: account-level concurrency, reserved concurrency (caps + reserves), provisioned concurrency (warms instances + costs money), and what each one does on cold starts. Know that Lambda inside a VPC needs ENI provisioning (Hyperplane ENIs now amortize this) and that environment variables can be encrypted with a customer-managed KMS key.

DynamoDB design is the trip-up domain. Build a mental model: partition key chooses the partition, sort key orders within the partition, GSI is a fully separate table that may have a different PK + SK and is eventually consistent, LSI shares the partition key + must be created with the table. Memorize when an UpdateItem with a condition will fail with `ConditionalCheckFailedException` vs throw a `ProvisionedThroughputExceededException`.

CodeDeploy deployment configurations differ per compute platform — this catches candidates who studied the EC2 modes and assumed Lambda works the same way. EC2 = AllAtOnce / HalfAtATime / OneAtATime (in-place). Lambda = AllAtOnce / Linear / Canary (traffic-shifting on aliases). ECS = blue/green only, via ALB target-group swap. AppSpec.yml lifecycle hooks (BeforeAllowTraffic, AfterAllowTraffic, etc.) are platform-specific too.

CloudFormation intrinsic-function questions hinge on knowing what `!Ref` returns for each resource type. `!Ref MyEC2Instance` returns the instance ID; `!Ref MyS3Bucket` returns the bucket name; `!Ref MyParameter` returns the parameter value. `!GetAtt` exposes specific attributes — e.g. `!GetAtt MyEC2.PublicDnsName`. Memorize the common ones (EC2, S3, RDS, Lambda, IAM Role) and use !Sub for inline string interpolation.

Cognito user pools vs identity pools is a near-guaranteed question. User pools sign users in and issue JWTs; identity pools take a token (from a user pool, SAML IdP, social provider, or even unauthenticated guest) and exchange it for temporary IAM credentials so the app can call AWS APIs. Pick user pool when the app needs a username/password sign-in; pick identity pool when the app needs temporary STS credentials for the signed-in user.

KMS envelope encryption shows up often. The flow is: call `GenerateDataKey` and get back a plaintext data key + a ciphertext (encrypted-by-CMK) data key. Encrypt your large object with the plaintext key, then throw the plaintext away and store the ciphertext data key alongside the object. To decrypt, call `Decrypt` on just the small ciphertext data key. The exam loves this because it tests both the API and the security pattern.

Secrets Manager vs SSM Parameter Store comes up repeatedly. Secrets Manager: rotation built-in (Lambda-driven), $0.40 per secret per month, JSON-shaped values. Parameter Store: free standard tier, no built-in rotation, can store String / StringList / SecureString (KMS-encrypted), advanced tier for >4 KB or higher throughput. Prefer Secrets Manager when you need rotation; Parameter Store for plain config and tighter cost.

Watch for keyword traps in the stem. 'Without changing application code' usually means use Lambda environment variables, Parameter Store references, or Lambda layers (not a redeploy). 'Least operational overhead' favours managed/serverless. 'Real-time' means streaming (Kinesis, DynamoDB Streams, EventBridge) not batch. 'At-least-once' / 'exactly-once' steers SQS Standard vs FIFO. 'Eventually consistent is acceptable' opens the door to GSI reads, S3 list-after-write, DynamoDB defaults.

Time budget: 65 questions in 130 minutes is exactly 2 minutes each. Code-snippet questions (CloudFormation YAML, IAM policy JSON, Lambda code) eat 3-4 minutes. Sweep the exam in two passes: bank the easy SDK / service-knowledge questions first, flag the long code reads for a second pass. The 15 unscored questions are sprinkled in randomly and you cannot identify them, so answer every question.