4.14 API Gateway stages and Lambda aliases

API Gateway stages

Use stages for separate deployed API environments such as development, test, staging, and production.

Lambda aliases

A Lambda alias is a stable pointer to a published function version.

Use aliases to:

• Test approved versions
• Promote versions without changing callers
• Support weighted routing for rollout
• Avoid depending directly on mutable $LATEST

Trap: Automated integration tests should not target $LATEST if code can change underneath them.

4.15 Testing

Test layers

Mock external dependencies

Mock paid or unreliable third-party APIs for repeatable automated testing. Keep a smaller controlled set of end-to-end tests for real integrations.

Test fixtures

Create representative JSON payloads for:

• Lambda events
• API Gateway requests
• EventBridge events
• SQS messages
• Stream records
• Failure paths and malformed payloads

Amazon Q Developer can assist in proposing tests, but generated tests still require review and execution.

4.16 CI/CD service responsibilities

Frequent exam trap

• If the question asks who orchestrates stages, choose CodePipeline.
• If it asks who runs build commands, choose CodeBuild.
• If it asks who shifts application traffic or manages rollout, choose CodeDeploy where applicable.

4.17 Deployment strategies

Canary example

A new Lambda version should receive 10% of traffic initially, then all traffic only if alarms remain healthy.

Use:

• Published Lambda version
• Alias
• Weighted traffic shift
• CodeDeploy deployment configuration
• CloudWatch alarms
• Automatic rollback

Rollback rule

When a release clearly increases errors and a last known-good version exists, rollback first to restore service. Preserve logs and traces for later root cause analysis.

Domain 4: Troubleshooting and Optimization

4.18 Choose the right evidence source

Logging vs monitoring vs observability

4.19 Structured logging and correlation IDs

Emit structured JSON logs with consistent fields, for example:

{
  "timestamp": "2026-06-03T10:15:00Z",
  "level": "ERROR",
  "requestId": "req-123",
  "correlationId": "order-987",
  "tenantId": "tenant-a",
  "operation": "CreateOrder",
  "errorCode": "PAYMENT_TIMEOUT"
}

Benefits:

• Search by errorCode
• Group by tenant or operation
• Trace a transaction across services
• Build metrics from log fields
• Avoid unreliable free-text parsing

For asynchronous flows, propagate a correlation ID through message attributes or event fields.

4.20 AWS X-Ray

Use X-Ray when the scenario asks:

• Which downstream segment is slow?
• Where is latency added?
• Which service returns errors in a distributed request path?
• How can traces be filtered by tenant tier or operation?

Use annotations for indexed trace-filter fields. Use metadata for extra context that does not require indexed filtering.

4.21 CloudTrail

Use CloudTrail for AWS API activity:

• Who changed a Lambda configuration?
• Which identity modified a resource?
• When was an AWS API call made?

Do not use CloudTrail as a replacement for application logs or distributed traces.

4.22 Metrics, alarms, and health checks

Custom metrics

Emit a custom metric when the business signal exists only in application events, such as checkout failures or order-processing latency.

Alarms

Use CloudWatch alarms and SNS notifications when operations needs alerts for:

• Error-rate thresholds
• Quota risk
• Deployment health
• Latency thresholds
• Resource utilization

Readiness probes

A readiness probe should report ready only after the service is actually able to serve traffic. This prevents traffic from reaching a container that has started but has not initialized dependencies.

4.23 Optimization patterns

Lambda optimization

• Benchmark memory settings for CPU-bound work.
• Measure duration and cost together.
• Review concurrency limits.
• Profile expensive code paths.
• Investigate downstream latency.
• Use caching where appropriate.

Messaging optimization

Use SNS subscription filter policies so a subscriber receives only relevant messages. Avoid delivering everything and discarding most records in consumers.

CloudFront cache key optimization

Include only request headers, cookies, and query strings that actually affect the response. Unnecessary cache-key variation lowers cache-hit ratio.

Application-level caching

Use a cache-aside strategy with ElastiCache for frequently requested, low-volatility records:

1. Read cache.
2. On miss, read database.
3. Store value with suitable TTL.
4. Return value.
5. Invalidate or refresh appropriately when data changes.

Performance investigation rule

Do not blindly add capacity. First:

1. Inspect metrics.
2. Query logs.
3. Trace cross-service latency.
4. Profile code.
5. Identify the bottleneck.
6. Optimize the cause.
7. Re-measure.

5. Service Selection Guide

Application integration

Security

Data

Deployment

Observability

6. Architecture Patterns

6.1 Durable fanout

Scenario: Billing, analytics, and notifications must independently process the same order event.

Producer
   |
   v
SNS topic
   |-------------------|-------------------|
   v                   v                   v
SQS billing queue   SQS analytics queue  SQS notification queue
   |                   |                   |
Billing worker      Analytics worker     Notification worker

Why it works:

• Every consumer receives a copy.
• Each queue buffers independently.
• Each consumer retries independently.
• A slow consumer does not block others.

Wrong design: One shared SQS queue. That load-balances messages between workers instead of delivering every event to every consumer.

6.2 EventBridge routing

Scenario: Producers publish business events. Consumers subscribe only to matching event types or attributes.

Producer -> EventBridge event bus -> Rule: order.created -> Fulfillment
                                  -> Rule: region=EU     -> Compliance
                                  -> Rule: highValue     -> Review workflow

Use EventBridge when the question emphasizes event-bus rules, attribute-based routing, loosely coupled consumers, or producers that should not know their subscribers.

6.3 Idempotent queue consumer

SQS message -> Read idempotency key -> Check persistence store
            -> If already completed: acknowledge safely
            -> If new: apply side effect + record completion

Use this for payments, order creation, provisioning, and any side effect that must not happen twice.

6.4 Serverless API with validation and authorization

Client
  |
HTTPS
  |
API Gateway
  |-- Validate request model
  |-- Validate token with authorizer
  |
Lambda
  |-- Enforce business authorization
  |-- Use execution role
  |
DynamoDB / downstream services

Key lesson: Different layers enforce different responsibilities.

• API Gateway: structural validation and token validation
• Lambda: business authorization and tenant rules
• IAM role: permission to call AWS services
• DynamoDB design: efficient data access

6.5 Safe Lambda release

Code commit
   |
CodePipeline
   |
CodeBuild -> tests -> packaged artifact
   |
CodeDeploy
   |
Lambda alias
   |-- 10% -> new version
   |-- 90% -> previous version
   |
CloudWatch alarms -> promote or rollback

6.6 Multi-tenant access pattern

Validated token claims
   |
Trusted tenantId
   |
Backend authorization
   |
Tenant-scoped query
   |
Only allowed records returned

Never accept the tenant boundary solely from an untrusted request-body field.

6.7 Troubleshooting workflow

User symptom
   |
Check metrics and alarms
   |
Query structured logs by requestId / correlationId
   |
Inspect X-Ray traces for cross-service latency
   |
Check CloudTrail only when AWS configuration changes are suspected
   |
Fix root cause and re-measure

7. Exam Traps

Trap 1: Scan with a filter expression

A filtered Scan still reads broadly before filtering. If the partition key is known, use Query. If an alternate lookup is required, consider a GSI.

Trap 2: One shared SQS queue for fanout

One queue distributes work among consumers. It does not give every consumer a copy. Use SNS plus separate SQS queues.

Trap 3: SNS when durable independent buffering is required

SNS provides fanout, but queues provide durable buffering and independent retries. Combine them.

Trap 4: Standard SQS queue with strict-order assumptions

Standard queues do not guarantee strict ordering. Use FIFO when ordered processing and deduplication requirements justify it.

Trap 5: Infinite retries

Immediate unlimited retries create retry storms. Use bounded exponential backoff with jitter and a circuit breaker for failing external services.

Trap 6: Increasing timeout as a performance fix

Timeout changes maximum execution duration; it does not optimize CPU-bound code. For Lambda, benchmark memory and inspect the root cause.

Trap 7: Putting Lambda in a public subnet for internet access

A VPC-attached Lambda function does not receive a public IP just because it uses a public subnet. Use correct private-subnet routing and outbound access.

Trap 8: Long-lived credentials in code

Reject embedded IAM access keys. Prefer roles, temporary credentials, and STS.

Trap 9: Authentication without authorization

A valid token identifies a caller. It does not prove the caller can access another tenant's data or perform every action.

Trap 10: Confusing Secrets Manager, Parameter Store, and AppConfig

• Secret with rotation: Secrets Manager
• Parameter: Parameter Store
• Controlled feature-flag rollout: AppConfig

Trap 11: Sending large plaintext payloads directly to KMS

Use envelope encryption. Encrypt payloads with a data key; use KMS to protect the data key.

Trap 12: Trusting HTTPS to solve at-rest encryption

TLS protects transit. Use at-rest encryption separately.

Trap 13: Rebuilding artifacts per environment

Build once and promote the tested artifact. Inject environment configuration externally.

Trap 14: Confusing CI/CD services

• CodePipeline orchestrates.
• CodeBuild executes build commands.
• CodeDeploy manages rollout.

Trap 15: Testing against $LATEST

Use a published Lambda version through an alias for stable integration testing.

Trap 16: Using logs when traces are required

Logs help inspect events. X-Ray reveals end-to-end request paths and segment latency.

Trap 17: Using CloudTrail for application debugging

CloudTrail records AWS API activity. Use application logs for application behavior and X-Ray for distributed tracing.

Trap 18: Adding capacity before measuring

Use metrics, logs, traces, and profiling to find the bottleneck first.

Trap 19: Logging sensitive values because logs are encrypted

Sanitize before logging. Encryption does not justify collecting unnecessary secrets or personal data.

Trap 20: Returning all tenant records and filtering in the browser

Enforce tenant scope on the trusted backend before data is returned.

How to eliminate bad options quickly

Reject answers that:

• Embed credentials
• Grant administrator access unnecessarily
• Poll a database when an event service fits
• Use Scan when Query or an index fits
• Treat SQS as exactly-once
• Treat SNS as a workflow orchestrator
• Increase timeout without investigating
• Rebuild artifacts instead of promoting immutable ones
• Depend on $LATEST
• Expose sensitive values in logs
• Fix an application concern with an unrelated service

8. Quick Memory Rules

Messaging

• Queue = buffer work.
• Topic = fan out.
• Event bus = route events by rules.
• State machine = coordinate steps.
• Stream = process ordered high-volume records.
• At-least-once delivery = design idempotently.
• Poison message = DLQ.
• Duplicate processing before completion = inspect visibility timeout.

Lambda

• Slow CPU-bound Lambda = test more memory.
• Critical Lambda capacity = reserved concurrency.
• Private RDS + public API call = VPC private access plus outbound route.
• Async failure routing = destination or DLQ, depending on pattern.
• Reusable libraries = layer.
• Stable release target = alias to version.

DynamoDB

• Known partition key = Query.
• Unknown alternate lookup = GSI.
• Hot key = redesign or shard.
• Immediate latest read = strongly consistent read where supported.
• Auto-expiring item = TTL.
• Full-text relevance search = OpenSearch, not Scan.

Security

• Workload credential = IAM role.
• Cross-account temporary access = STS AssumeRole.
• App-user login = Cognito.
• Temporary object upload = S3 presigned URL.
• Secret with rotation = Secrets Manager.
• Feature flag rollout = AppConfig.
• Payload encryption at scale = envelope encryption.
• Transit protection = TLS.
• Tenant boundary = trusted claim + backend enforcement.

Deployment

• Orchestrate stages = CodePipeline.
• Run build commands = CodeBuild.
• Shift rollout traffic = CodeDeploy.
• Repeatable stack = SAM / CloudFormation.
• Safe promotion = immutable artifact.
• Fast environment rollback = blue/green.
• Small initial exposure = canary.

Troubleshooting

• Search application events = CloudWatch Logs Insights.
• Business threshold = custom metric + alarm.
• Cross-service latency = X-Ray.
• Indexed trace filters = annotations.
• Who changed AWS config = CloudTrail.
• Container started but not ready = readiness probe.
• Cache misses from unnecessary header variation = simplify cache key.

9. Final Revision Notes

Highest-priority services

Spend extra revision time on:

1. AWS Lambda
2. Amazon DynamoDB
3. Amazon SQS
4. Amazon SNS
5. Amazon EventBridge
6. Amazon API Gateway
7. IAM and AWS STS
8. AWS KMS
9. Secrets Manager, Parameter Store, and AppConfig
10. AWS SAM and CloudFormation
11. CodePipeline, CodeBuild, and CodeDeploy
12. CloudWatch, Logs Insights, X-Ray, and CloudTrail

Five comparison sets to master

SQS vs SNS vs EventBridge vs Step Functions vs Kinesis

Know whether the requirement is:

• buffering
• fanout
• routing
• orchestration
• streaming

IAM role vs Cognito vs STS

Know whether the caller is:

• an AWS workload
• an application user
• a cross-account principal

Secrets Manager vs Parameter Store vs AppConfig

Know whether the value is:

• a rotatable secret
• a central parameter
• a controlled runtime configuration or feature flag

CloudWatch Logs vs X-Ray vs CloudTrail

Know whether you need:

• application records
• distributed request traces
• AWS API audit events

CodePipeline vs CodeBuild vs CodeDeploy

Know whether you need:

• stage orchestration
• build execution
• deployment rollout

Rapid scenario drills

Last-minute caution list

• Read whether the question asks for one answer or two or more.
• Prefer the answer that solves the stated constraint, not a broader redesign.
• Do not over-engineer a simple queue or validation scenario.
• Do not under-engineer resilience: retries require idempotency and limits.
• Treat security answers with embedded credentials as suspicious.
• Separate configuration, secret, and feature rollout concerns.
• Separate logs, metrics, traces, and audit events.
• Remember that scored performance is compensatory across domains: maximize total correct answers.

10. Exam-Day Checklist

Before starting

• Confirm whether each question is single-answer or multiple-response.
• Budget time so you can revisit flagged questions.
• Expect plausible distractors based on incomplete knowledge.
• Answer every question; unanswered questions are incorrect and guessing has no additional penalty.

For each question

1. Underline the main requirement mentally.
2. Identify the application layer involved.
3. Match the requirement to the smallest appropriate managed feature.
4. Eliminate insecure answers first.
5. Eliminate answers that solve a different problem.
6. Compare the final two options against the exact wording.
7. Flag time-consuming questions and return later.

Final review

Before submitting, recheck questions containing:

• MOST secure
• least operational overhead
• ordered
• temporary
• cross-account
• before invoking the backend
• near real time
• without changing code
• independent retries
• fine-grained authorization
• root cause
• rollback

Official Alignment References

• AWS Certified Developer – Associate (DVA-C02) exam guide:
  https://docs.aws.amazon.com/aws-certification/latest/developer-associate-02/developer-associate-02.html

• DVA-C02 guide revisions, including version 2.1:
  https://docs.aws.amazon.com/aws-certification/latest/developer-associate-02/dva-02-revisions.html

• AWS Certified Developer – Associate certification page:
  https://aws.amazon.com/certification/certified-developer-associate/