ExamPark
Course menuDVA-C03

Exams / DVA-C03 / Study guide

AWS Certified Developer – Associate (DVA-C03) study guide

What the DVA-C03 exam tests, domain by domain, and how to tell the right answer from the nearly right one. Each topic links to fuller study notes and free practice questions.

Last checked against the official exam guide and AWS documentation · How we write our content

About the DVA-C03 exam

The AWS Certified Developer – Associate exam checks whether you can build, deploy, secure and debug applications on AWS. It is aimed at people with at least a year of hands-on experience developing and maintaining AWS-based applications, who can write code in at least one supported language and call AWS services through an SDK or the CLI.
Questions 65: 50 scored and 15 unscored, which aren’t marked
Time 130 minutes
Question types Multiple choice (one correct answer from four) and multiple response (two or more correct answers from five or more)
Score Scaled from 100 to 1,000; 720 to pass
Scoring model Compensatory: you need to pass overall, not in each domain
Cost $150 USD
Guessing There is no penalty for a wrong answer, so answer every question

Check the official certification page for the current languages, regional prices and booking options before you book.

DVA-C02 or DVA-C03?

DVA-C02 is the current version until its last day, November 30, 2026. DVA-C03 is the version you sit from December 1, 2026. If you book for December or later, study DVA-C03.

DVA-C03 keeps everything DVA-C02 tests. It reweights the four domains, adds a new task on securing AI services (Task 2.3), and adds skills on AI-assisted development tools, managed AI services such as Amazon Bedrock, and building and deploying containers. Kiro is the AI development tool to know, because the Amazon Q Developer IDE plugins closed to new customers in May 2026. The exam guide also moves some content: unit testing with AWS SAM moves to Testing and Deployment, and Lambda performance tuning moves to Troubleshooting and Optimization.

For the full list of what changed, read the DVA-C03 change guide.

Services added and removed in DVA-C03

AWS publishes a list of in-scope services with each exam guide. The list isn’t complete, but a service that joins it is a strong hint that questions will name it. These are the differences between the DVA-C02 list and the DVA-C03 list.

Added to the in-scope list

Service What to know Study notes
Amazon Bedrock Calling foundation models from your code with the Converse API, model access, Guardrails and keeping prompts private Calling Amazon Bedrock from application code, AI service access and data privacy, Guardrails and securing AI agents
Amazon Bedrock AgentCore Running and securing AI agents: runtime, identity, memory and tool gateways Calling Amazon Bedrock from application code, Guardrails and securing AI agents
Kiro AI-assisted development with specs, steering files and hooks; it replaces Amazon Q Developer in the IDE AI-assisted development with Kiro
Amazon Quick AWS’s AI workspace for business users, with chat agents, research, automated flows and Quick Sight dashboards. Know it by name: it connects to your data and apps through connectors, MCP and OpenAPI Calling Amazon Bedrock from application code
Amazon Data Firehose Loading streaming data into Amazon S3, Amazon OpenSearch Service and other destinations, with optional Lambda transforms Streaming data with Kinesis
AWS PrivateLink Interface VPC endpoints that keep calls to AWS services, including Amazon Bedrock, off the internet AI service access and data privacy, Lambda and VPC access
AWS Certificate Manager (ACM) Public certificates for load balancers, CloudFront and API Gateway, with automatic renewal Certificates and encryption in transit
AWS Private CA A private certificate authority for internal names and mutual TLS Certificates and encryption in transit
Amazon S3 Glacier Archive storage classes, restoring archived objects before reading them, and restore events Amazon S3 for developers
AWS SAM Already tested in DVA-C02, now listed by name: templates, sam build, sam deploy and local testing AWS SAM, CloudFormation and CDK, Testing and test automation
Amazon CloudWatch Logs Already tested in DVA-C02, now listed by name: log groups, retention, Logs Insights and metric filters Logging and CloudWatch Logs Insights

Removed from the in-scope list

Service What it means for you
AWS AppSync GraphQL APIs are no longer listed. Don’t spend study time on AppSync resolvers; Amazon API Gateway is the API service to know.
Amazon Q Developer Replaced by Kiro. The Q Developer IDE plugins closed to new customers in May 2026, so AI-assisted development questions now name Kiro.

Changes to the out-of-scope list

The out-of-scope list now also names Amazon SageMaker AI, Strands Agents and AWS Transfer Family. If an answer depends on training your own model in SageMaker AI or writing agent code with the Strands Agents SDK, it is unlikely to be the one the exam wants: DVA-C03 tests calling managed AI services, mainly Amazon Bedrock. Amazon Chime is no longer listed, because AWS has shut the service down. Amazon Quick Sight stays out of scope, even though Amazon Quick, which includes it, is in scope.

What the exam really tests

Developer questions are short scenarios, usually one service or a small chain of services, and the right answer is the one a working developer would ship. A few themes run through the whole exam:

  • Use the native integration. An event source mapping, a built-in retry or a managed trigger usually beats polling code you write yourself.
  • Know where credentials come from. Roles, temporary credentials from STS, the default credential chain and secrets stores decide most security questions. Long-lived access keys in code are almost always wrong.
  • Design for failure. Retries with backoff, idempotent handlers, dead-letter queues and throttling come up in nearly every messaging and serverless question.
  • Deploy in repeatable steps. SAM or CloudFormation templates, versioned Lambda functions with aliases, and CodePipeline stages with rollback beat manual console changes.
  • Debug from the evidence. Logs Insights queries, custom metrics, alarms and traces show where a request failed. Guessing at code is rarely the answer the exam wants.

How to read a question

  1. Read the last sentence first to see what is being asked and the qualifier: least code, lowest cost, most secure, least operational effort, fastest debugging.
  2. List the hard constraints: language or runtime, existing services, whether the data must stay private, and whether the call is synchronous or asynchronous.
  3. Eliminate answers that need custom servers, long-lived keys, or code that the managed service already does for you.
  4. Between the last two, pick the answer that uses the AWS feature built for that job, with the smallest change.

Pace yourself: 130 minutes for 65 questions is about two minutes each. Flag hard questions and come back to them.

How the domains add up

Development with AWS Services is the largest domain at 30%. Security follows at 26%, then Testing and Deployment and Troubleshooting and Optimization at 22% each. In DVA-C02, Development was 32%, Security 26%, Deployment 24% and Troubleshooting 18%, so Troubleshooting has grown the most.

The domains overlap. A deployment question often turns on IAM permissions, and a troubleshooting question often turns on a Lambda timeout or a DynamoDB throughput setting that you first met while building the feature.

Domain 1: Development with AWS Services 30%

This domain is the largest, at 30 percent of scored questions, and covers building applications with AWS services. It asks you to choose a messaging, API, orchestration or data service and to configure Lambda, DynamoDB, caching and S3 for correct and efficient access. New for DVA-C03 are AI-assisted development with Kiro and calling Amazon Bedrock and AgentCore agents from application code.

An event-driven serverless order flow A client calls API Gateway, which invokes a Lambda function that writes the order to a DynamoDB table. DynamoDB Streams invokes a second Lambda function for each change. That function publishes to an SNS topic, which fans out to an email subscription and an SQS queue. Client HTTPS API Gateway invoke Lambda saves the order PutItem DynamoDB table stream enabled stream record Lambda processes the change publish SNS topic Email SQS queue
A common serverless shape. The API call returns as soon as the order is saved, and everything after that runs asynchronously. DynamoDB Streams invokes the second function with each change, and SNS fans the event out to every subscriber, such as an SQS queue that another service reads at its own pace.

Domain 2: Security 26%

Security is 26 percent of the exam and covers three areas: authentication and authorization (Cognito, IAM roles, STS, presigned URLs and API authorization), encryption and sensitive data (KMS, certificates, Secrets Manager and Parameter Store, PII masking in logs), and, new in DVA-C03, the security of AI services (private access to Amazon Bedrock, guardrails on inputs and outputs, and controls on AI agents). Most questions ask you to pick the smallest change that meets a stated rule, so learn which service owns each control.

How a Cognito user pool and identity pool work together A mobile app signs users in with a Cognito user pool and receives tokens. The app calls API Gateway with the JWT, and API Gateway checks it before invoking Lambda. Separately, the app swaps the token at a Cognito identity pool for temporary AWS credentials and uses them to upload directly to Amazon S3. Mobile app User pool sign-in, issues JWTs sign in call with JWT swap JWT API Gateway checks the JWT Identity pool gives temp AWS creds Lambda Amazon S3 direct upload
Two different Cognito parts. The user pool signs users in and issues JWTs, which API Gateway can check with a Cognito authorizer before invoking Lambda. The identity pool swaps that token for temporary AWS credentials, limited by an IAM role, so the app can call services such as S3 directly. Never put long-term access keys in an app.

Domain 3: Testing and Deployment 22%

This domain covers getting application code into AWS safely and repeatably: packaging dependencies and environment-specific configuration, writing and running tests (SAM, CDK, CloudFormation, mock APIs and test events), managing Lambda versions, aliases and API Gateway stages, building and deploying with CodePipeline, CodeBuild and CodeDeploy, choosing blue/green, canary, linear or rolling releases with automatic or manual rollback, and deploying containers with ECR, ECS and EKS. It is 22% of DVA-C03, down from 24% in DVA-C02, and it gains container image management and AI-assisted testing and CI/CD skills, while unit testing with SAM moves here from the development domain.

A canary deployment of a Lambda function with CodeDeploy Clients call API Gateway, which invokes the Lambda alias named live. The alias sends 90 percent of traffic to version 1 and 10 percent to version 2. Version 2 reports errors to a CloudWatch alarm. If the alarm fires, CodeDeploy moves the alias back to version 1. Clients API Gateway Alias “live” 90% 10% Version 1 current Version 2 new CloudWatch alarm errors on version 2 fires CodeDeploy shifts or rolls back
In a canary deployment, CodeDeploy points the alias at both versions: 10% of traffic goes to the new version for a set time, then all of it. If a CloudWatch alarm fires during that window, CodeDeploy moves the alias back to version 1 automatically. Clients always call the alias, so nothing changes on their side.

Domain 4: Troubleshooting and Optimization 22%

This domain covers finding and fixing what breaks, and making a working application faster and cheaper. Expect to read Lambda and application logs, query them with CloudWatch Logs Insights, interpret custom metrics, alarms, traces and health checks, and work out a root cause from CloudFormation, CodeBuild and CodeDeploy output, CloudTrail records and the AI-assisted investigation tools. The optimization half asks you to choose the right lever for latency and cost: Lambda memory and concurrency, connection reuse, Auto Scaling, caching with ElastiCache, DAX, CloudFront and API Gateway, and message batching and filtering with SQS and SNS.

A 6-week study plan

This plan assumes about an hour on weekdays and a longer hands-on session at the weekend. It gives Development 30% of your time, Security and Deployment a bit less, and Troubleshooting and Optimization the last week before the practice exams. If you already build serverless applications on AWS every day, you can move faster through weeks 1 and 2.

Week Domain (weighting) Study Build this
1 Development (30%) Take the free practice exam in timed mode first. Then Lambda configuration, invocation types, error handling and destinations, Lambda and VPC access, and SDK credentials, retries, backoff and error handling. A Lambda function with environment variables, a Lambda alias, and a function that fails on purpose so you can see retries and a destination.
2 Development (30%) Synchronous versus asynchronous patterns, SQS, SNS and EventBridge (filtering, dead-letter queues), Step Functions, Kinesis basics, and building APIs with API Gateway (Lambda proxy integration, request validation, mapping templates). Then AI-assisted development with Kiro and calling Amazon Bedrock from the SDK. An API Gateway REST API backed by Lambda that writes to SQS, a Step Functions workflow that calls two Lambda functions, and a Lambda function that calls the Bedrock Converse API.
3 Development (30%) and Security (26%) Choosing a data store by access pattern, DynamoDB keys, indexes and consistency, query versus scan, data lifecycles (S3 Lifecycle rules, DynamoDB TTL, log retention), caching with ElastiCache and DAX, S3 presigned URLs and event notifications. Then IAM roles and STS, and the difference between identity-based and resource-based policies. A DynamoDB table with a global secondary index, queried with the SDK, and a Lambda role that can read one table and nothing else.
4 Security (26%) Cognito user pools and identity pools, API authorization (Cognito authorizers, IAM auth, Lambda authorizers), KMS key types and key policies, ACM certificates, Secrets Manager and Parameter Store, and Task 2.3 on AI service access, privacy and guardrails. A Cognito user pool that protects an API Gateway route, a secret read at runtime from Secrets Manager, and a Bedrock Converse call made through a VPC endpoint.
5 Testing and Deployment (22%) Packaging and configuration (AppConfig, Parameter Store, API Gateway stages and stage variables), SAM and CloudFormation templates, CDK basics, unit and integration testing with SAM, CodeBuild and CodePipeline, CodeDeploy traffic shifting, container images in ECR and deployments to ECS and EKS, and rollback. A SAM application with a test event and a canary deployment through CodeDeploy that you break on purpose to watch it roll back.
6 Troubleshooting and Optimization (22%) CloudWatch Logs and Logs Insights queries, custom metrics and alarms, X-Ray and OpenTelemetry tracing, Lambda memory and concurrency (including provisioned concurrency), health checks, SQS and SNS messaging patterns, and caching and performance bottlenecks. A Lambda function that emits a custom metric and a structured log line, an alarm on its errors, and a Logs Insights query that finds the slowest requests.

Spend the last days of week 6 on full timed practice exams. Review every wrong answer and rebuild the piece you got wrong in your own account.

How to use practice questions well

  • Practice the length. Do full 65-question sets in 130 minutes so the stamina demand isn’t a surprise on the day.
  • Read the wrong options. They are usually real features that solve a neighboring problem, or the right service with the wrong setting.
  • Don’t memorize questions. The real exam won’t reuse them, and memorized answers fail on the next scenario.
  • Aim for consistent scores of about 80% or more across several full timed practice exams before you book.

Get hands-on

Use a personal account with a budget alert set. Build one serverless path end to end: an API Gateway route, a Lambda function that writes to DynamoDB and an SQS queue, a second function that processes the queue, and a SAM template that deploys it all. Then break it on purpose (a wrong IAM policy, a short timeout, a bad alias) and find the failure in CloudWatch Logs. Delete everything afterward.

Frequently asked questions

How hard is the DVA-C03 exam?

It is an associate exam with a passing score of 720 on a 100 to 1,000 scale. Most questions are one or two steps from the basics, but the wording is precise. The hardest questions usually turn on a single detail, such as which role a call uses or whether a DynamoDB read is strongly consistent.

How long should I study?

Most candidates with some AWS development experience study for six to eight weeks at about five to seven hours a week. If you are new to AWS, plan for more time and spend extra hours in the console building the labs above.

What experience do I need?

AWS recommends about a year of hands-on development experience on AWS. You don’t need to have used every service, but you should have built and deployed an application, debugged a failing Lambda function and set up a role for a service.

What changed from DVA-C02 to DVA-C03?

The same core content stays, with different domain weightings. DVA-C03 adds Task 2.3 on AI security, AI-assisted development and testing tools, managed AI services such as Amazon Bedrock, and container deployments. It also drops the Amazon Q Developer IDE plugins from its tool list. If you are sitting DVA-C02 before November 30, 2026, you can skip the AI and container topics. The DVA-C03 change guide lists every change.

Which languages and SDK knowledge do I need?

You don’t write a full program on the exam, but you must read code. Expect short snippets in common SDK languages such as Python, JavaScript or Java, and the AWS CLI. Be ready to spot a wrong SDK call, a missing permission or a bad retry setting. Knowing how the SDK’s default credential chain and retry behavior work matters more than syntax.

Where can I practice for free?

ExamPark has a free DVA-C03 practice exam. Every question on this site is original, written from the public exam guide and checked against AWS documentation. Use it in timed mode in week 1 to find your starting point.

Test yourself

The free DVA-C03 practice exam has 78 questions with an explanation for every option. No sign-up needed.

Take the free practice examReview questions untimed

Want to be sure you're ready? The 5 full-length practice sets add 390 new questions, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets