Top 10 AWS DVA-C02 interview questions and how to answer them in 2026

The 10 questions

1. Lambda synchronous vs asynchronous invocation — how does retry differ?

Synchronous (API Gateway, ALB, direct SDK Invoke) returns the response to the caller and does not retry on error — retry is the client’s job. Asynchronous (S3, SNS, EventBridge) queues the event internally, returns 202, and Lambda retries twice on failure before dropping the event to a configured DLQ or on-failure destination. Stream-based sources (SQS, Kinesis, DynamoDB Streams) are a third category — they poll and retry until the record expires or succeeds. Saying “Lambda always retries” is the disqualifying answer.

2. When would you choose DynamoDB on-demand vs provisioned capacity?

On-demand is the right default for unpredictable, spiky, or brand-new workloads — you pay per request with no capacity planning. Provisioned + auto-scaling is roughly 6–7x cheaper once traffic is steady and predictable enough to forecast p95 RCU/WCU. Switching between modes is capped at once every 24 hours per table, so this is a monthly cost-tuning decision, not a per-request one. Interviewers listen for the cost delta and the switch cadence — both signal you’ve actually paid a DynamoDB bill.

3. How do you version and roll back a Lambda function safely?

Publish a numbered version, point an alias (e.g. prod) at it, and shift traffic with weighted alias routing (90/10, 50/50, etc.). Wire CodeDeploy pre-traffic / post-traffic hooks to CloudWatch alarms so error-rate spikes trigger automatic rollback. Never let production clients call $LATEST — it mutates on every deploy and defeats version pinning. The interviewer wants “Blue/Green with alias routing,” not “we redeploy and pray.”

4. What is the difference between a Cognito User Pool and an Identity Pool?

User Pools are the authentication service — they issue OIDC-compliant JWTs (ID token, access token, refresh token). Identity Pools exchange a token (from a User Pool, Google, SAML, etc.) for temporary AWS credentials via STS — that’s how a browser calls S3 or DynamoDB directly without a proxy. Most apps use both: User Pool for login, Identity Pool for federated AWS access. Conflating the two is the fastest way to fail this question.

5. How do you build an idempotent Lambda that consumes SQS messages?

SQS delivers at-least-once, so idempotency is the developer’s problem, not AWS’s. Standard pattern: extract a stable idempotency key (SQS MessageId, an upstream event ID, or a request-scoped UUID), do a DynamoDB PutItem with attribute_not_exists on that key inside the handler, and skip the side effect if the put fails. AWS Powertools for Lambda ships an @idempotent decorator that wraps this exact pattern — mentioning it earns points. Never rely on the SQS visibility timeout alone.

6. API Gateway REST vs HTTP API — which do you pick in 2026?

HTTP API is the default in 2026 — it’s about 70% cheaper than REST, has lower latency, and covers 90% of use cases (JWT auth, CORS, Lambda proxy). REST API remains the answer only when you need one of its exclusive features: request/response transformation via VTL templates, per-client usage plans + API keys, WAF integration, private endpoints via VPC PrivateLink, or client certificate auth. Saying “always REST” is a red flag — it signals you’ve been away from AWS since 2020.

7. How would you orchestrate a multi-step workflow with error handling?

Step Functions Standard for long-running, exactly-once, auditable workflows (up to 1 year) — billed per state transition, and every execution is visible in the console. Step Functions Express for high-volume, short-duration (<5 min), at-least-once workflows — billed per execution, cheaper at scale but without the per-execution history. Chaining Lambdas by SQS is the wrong answer for workflows with branching, retries, or a human-approval step — that’s exactly what Step Functions solves.

8. How do you securely inject database credentials into a Lambda?

Store the secret in AWS Secrets Manager (or SSM Parameter Store SecureString for lower cost), grant the Lambda execution role secretsmanager:GetSecretValue, and fetch on cold-start using the AWS Parameters and Secrets Lambda Extension — it caches the value locally so warm invocations don’t re-hit the API. Never hard-code secrets in environment variables in plaintext (they show up in GetFunction and in CloudTrail). Rotate credentials with a Secrets Manager rotation Lambda on a 30- or 90-day schedule.

9. What is a DynamoDB Global Secondary Index and when does it not help?

A GSI is an alternate partition/sort key over the same items — it lets you query by an attribute other than the primary key. It has its own RCU/WCU (or on-demand capacity) and is eventually consistent only — you cannot do a strongly-consistent read against a GSI. It doesn’t help when your access pattern hits every partition (a scan is still a scan), and it costs a write amplification for every base-table write that touches an indexed attribute. Adding a GSI to fix a Scan is often the right answer — adding five GSIs to fix a modelling problem is usually a rewrite hiding as an index.

10. How do you trace a request across API Gateway → Lambda → DynamoDB?

Enable AWS X-Ray on API Gateway and the Lambda function (Active tracing), then instrument the AWS SDK in code with AWSXRay.captureAWSv3Client(). Propagate the X-Amzn-Trace-Id header on downstream HTTP calls to keep the trace unified. The subsegment view shows Lambda init, DynamoDB call latency, and cold-start cost separately — that’s the p99 debugging story interviewers want to hear. In 2026, CloudWatch Application Signals extends this with SLO tracking on top of X-Ray traces; mentioning it signals you’ve worked on modern observability, not 2020’s.

What these questions test

Every question above has a “book answer” and an “operational answer.” Interviewers are looking for the operational version — the version that mentions the DynamoDB mode-switch cadence, HTTP API being 70% cheaper than REST, the idempotency-key pattern with attribute_not_exists, alias routing over $LATEST, X-Ray + Application Signals over “we have CloudWatch Logs.” Passing DVA-C02 proves you know the services. Answering these correctly proves you’ve shipped serverless workloads that survive production.

Frequently asked questions