AWS Certification Developer Associate 2026 past questions and answers

1. Use UpdateItem with a condition expression that the current status is OPEN, and change the status to CLAIMED in the same request.
2. Read the item, check that its status is OPEN, and then issue an unconditional UpdateItem request.
3. Place a short delay before each update so concurrent invocations are less likely to overlap.
4. Write each claim to a separate DynamoDB table and periodically reconcile duplicate claims.

Answer: A. Use UpdateItem with a condition expression that the current status is OPEN, and change the status to CLAIMED in the same request.

A conditional update makes the state check and write atomic, so only one concurrent request can change OPEN to CLAIMED. A separate read followed by an unconditional write has a race window.

1. Set the queue visibility timeout to zero after each successful record.
2. Enable partial batch responses on the event source mapping and return the message identifiers of failed records in batchItemFailures.
3. Delete every message manually before processing it, then recreate any message that fails.
4. Increase the batch size so successful records are less likely to be retried.

Answer: B. Enable partial batch responses on the event source mapping and return the message identifiers of failed records in batchItemFailures.

With partial batch responses enabled, Lambda can report individual failed SQS records and successful records are not retried as part of the batch. Changing visibility timeouts or batch size does not provide per-record acknowledgement.

1. Pass the token in a query string and validate it in every backend database query.
2. Create an EC2-hosted service that downloads and validates the user pool signing keys for every request.
3. Configure a JWT authorizer on the HTTP API for the Cognito user pool issuer and the API's expected audience.
4. Use an API key as a replacement for the Cognito access token.

Answer: C. Configure a JWT authorizer on the HTTP API for the Cognito user pool issuer and the API's expected audience.

An HTTP API JWT authorizer validates JWT signatures and configured issuer and audience claims at the API layer. API keys are not user authentication, and a custom EC2 validator adds unnecessary operational work.

1. Stream every upload through an always-on EC2 instance and then copy it to S3.
2. Send the file as a base64-encoded request body to a Lambda function and have the function write it to S3.
3. Allow anonymous write access to the upload bucket and ask users to include a unique filename.
4. Have the authenticated application issue short-lived presigned multipart upload URLs for the intended S3 object.

Answer: D. Have the authenticated application issue short-lived presigned multipart upload URLs for the intended S3 object.

Presigned multipart uploads let a client send large parts directly to S3 without proxying the file through application compute, while the application controls the authorized object and expiry. Anonymous bucket writes expose the bucket to unauthorized uploads.

1. Store the credential in AWS Secrets Manager, grant the function's execution role access to that secret, and configure rotation where supported by the provider.
2. Put the credential in the Lambda source code and restrict access to the deployment repository.
3. Store the credential in a public S3 object and rely on an unguessable object key.
4. Place the credential in a plaintext Lambda environment variable and share the function with all developers.

Answer: A. Store the credential in AWS Secrets Manager, grant the function's execution role access to that secret, and configure rotation where supported by the provider.

Secrets Manager provides encrypted secret storage, IAM-controlled retrieval, and managed rotation integrations or workflows where supported. Embedding credentials in code or publicly readable storage does not provide appropriate secret protection.