The AWS Lambda serverless platform now handles roughly 70% of all serverless workloads, and July 2026 brought a wave of updates that make it even more central to the DVA-C02 exam. Lambda MicroVMs, self-managed S3 code storage, and expanded Bedrock integrations have all shifted how AWS expects developers to design event-driven systems. Consequently, exam scenarios are leaning harder into “why choose Lambda over X” decisions rather than pure syntax recall.
This post kicks off a fresh DVA-C02 series with 10 practice questions on AWS Lambda serverless fundamentals. Each question mirrors the real exam pattern: one scenario, one constraint, four choices where three are plausible but only one fits. Therefore, read every scenario twice before scanning the options. For example, a question that mentions “unpredictable spiky traffic” is telling you the answer must scale to zero.
You will see a mix of difficulty. Specifically, three easy warmups start the set. Four medium design choices sit in the middle. Finally, three harder deep-dives cover concurrency, storage, and orchestration. As a result, this set should feel like a compressed diagnostic. In addition, every scenario ties back to a single decision axis that eliminates the plausible-but-wrong options. Consequently, if you can name that axis before scanning the choices, you already have the answer.
Before you begin, a quick tip on how to read AWS Lambda serverless questions on the real exam. First, scan for the constraint word — “cheapest,” “least operational overhead,” “highest availability,” or “least code change.” Next, ask which service satisfies that constraint. Finally, use the choices to confirm rather than to discover. Therefore, the exam becomes a matching game instead of a memory test.
Question 1: Compute Choice for Spiky, Unpredictable Traffic
Contoso, a streaming startup, is launching an image-thumbnail API. Traffic is unpredictable and often idle at night, then spikes when creators upload batches. The team wants to pay only for milliseconds of actual work and avoid managing servers. Which compute service best fits this profile?
A) Amazon EC2 Auto Scaling group behind an Application Load Balancer
B) AWS Fargate service on Amazon ECS with a fixed task count
C) AWS Lambda function invoked by an Amazon API Gateway HTTP API
D) Amazon Lightsail instance with a cron-driven worker
Reveal Answer
Correct Answer: C
Explanation: Lambda scales to zero when idle. Furthermore, it bills per millisecond, which matches spiky workloads perfectly. Option A still runs at least one EC2 instance. As a result, idle nights cost money. Fargate with a fixed task count also runs continuously. Therefore, it fails the “pay only for actual work” constraint. Lightsail is a fixed-size VM and adds no auto-scaling. Consequently, only Lambda satisfies both cost and no-server-management requirements at once.
Question 2: Cold-Start Latency for a Java Function
Fabrikam runs a Java-based order-lookup Lambda function fronted by API Gateway. P99 latency is fine for warm invocations, but cold starts occasionally exceed two seconds. The team wants the cheapest fix that does not require reserving warm capacity around the clock. Which feature should the team enable?
A) Provisioned concurrency at 100 warm instances all day
B) Lambda SnapStart on the published function version
C) Increase memory to 10 GB to speed up initialization
D) Rewrite the function in Node.js 22
Reveal Answer
Correct Answer: B
Explanation: SnapStart snapshots the initialized JVM after Init. On cold start, Lambda restores from that snapshot. As a result, Java cold starts drop to hundreds of milliseconds. Moreover, there is no extra per-invocation charge for supported runtimes. Provisioned concurrency works, but it bills continuously for reserved capacity. Consequently, it violates the cost constraint. Bumping memory helps a little. However, it does not solve JVM initialization overhead. A rewrite is a large project, not a fix. Therefore, SnapStart is the cheapest targeted answer.
Question 3: Simple Public HTTP Endpoint for a Utility Function
Your team needs a single public HTTPS endpoint for an internal utility function. There is no authentication requirement, only light traffic, and no need for request validation, throttling policies, or usage plans. Which option adds the least operational overhead?
A) Amazon API Gateway REST API with a Lambda proxy integration
B) Amazon CloudFront distribution with a Lambda@Edge origin
C) Application Load Balancer with a Lambda target group
D) A Lambda Function URL with AuthType set to NONE
Reveal Answer
Correct Answer: D
Explanation: Function URLs give you a dedicated HTTPS endpoint directly on the Lambda function. Specifically, there is no API Gateway, ALB, or CloudFront to configure. In addition, it is designed for exactly this “one function, one URL” pattern. API Gateway is powerful. However, it adds resource, method, stage, and deployment concepts you do not need. ALB with a Lambda target adds a paid load balancer. Meanwhile, Lambda@Edge is meant for CloudFront request/response manipulation, not a plain public endpoint. As a result, Function URL wins on simplicity.
Question 4: Workflow That Exceeds the 15-Minute Limit
The architecture team is designing a nightly report pipeline that currently takes about 45 minutes end to end. Steps include fetching data, transforming it, running a validation stage, and emailing results. The team wants to keep the individual steps as Lambda functions but must stay within Lambda limits. Which service should orchestrate the workflow?
A) Amazon EventBridge Scheduler triggering one long Lambda function
B) AWS Step Functions Standard workflow with Lambda task states
C) Amazon SQS FIFO queue with a single Lambda consumer
D) A single Lambda function with reserved concurrency of 45
Reveal Answer
Correct Answer: B
Explanation: Lambda functions have a hard 15-minute timeout. Therefore, a 45-minute pipeline cannot live in one invocation. Step Functions Standard workflows can run for up to a year. Furthermore, they coordinate multiple short Lambda tasks, retries, and branching. However, EventBridge alone still fires a single Lambda that would time out. Similarly, SQS with one consumer does not chain steps or handle failures declaratively. Reserved concurrency limits parallelism. Yet it does nothing to extend duration. Consequently, Step Functions is the correct orchestrator for AWS Lambda serverless workflows longer than 15 minutes.
Question 5: Handling Async Invocation Failures
Woodgrove Bank has a Lambda function invoked asynchronously by Amazon S3 events. When the function fails after all retries, the team wants each failed event and its metadata delivered to a downstream SQS queue for a triage system. They also want a separate SNS topic notified on successful runs. Which configuration meets both goals?
A) Configure a DLQ pointing to the SQS queue only
B) Configure Lambda Destinations for OnFailure to the SQS queue and OnSuccess to the SNS topic
C) Attach an EventBridge rule that filters CloudTrail Lambda events
D) Add a try/except in code that publishes to both the queue and topic
Reveal Answer
Correct Answer: B
Explanation: Lambda Destinations support both OnFailure and OnSuccess targets. In addition, they include the invocation payload plus response. Specifically, that is exactly what a triage system needs. Moreover, they are richer than a plain DLQ. A DLQ supports only OnFailure and only SQS or SNS as targets, with no success path. Similarly, CloudTrail-based EventBridge rules do not carry the invocation payload cleanly. Custom try/except code reinvents what Destinations provide natively. Furthermore, it adds failure modes. Therefore, Destinations is the idiomatic choice.
Question 6: Protecting a Sensitive Environment Variable
Northwind Traders stores a third-party API key in a Lambda environment variable. Auditors flagged that anyone with lambda:GetFunctionConfiguration can read plaintext values. The team wants the value encrypted at rest with a customer-managed key and decrypted only inside the function code. Which change satisfies the audit?
A) Rename the variable so its purpose is not obvious
B) Encrypt the variable with a customer-managed AWS KMS key and decrypt it inside the handler using the AWS SDK
C) Store the value in the function’s /tmp directory at build time
D) Move the value into the function’s deployment ZIP as a plaintext file
Reveal Answer
Correct Answer: B
Explanation: Lambda supports customer-managed KMS keys for environment variable encryption. When enabled, GetFunctionConfiguration returns ciphertext. Specifically, only callers with kms:Decrypt on that key can retrieve plaintext. Renaming a variable is security by obscurity. Therefore, it fails an audit. In addition, /tmp is ephemeral and never populated at build time. Bundling secrets into the ZIP just moves the plaintext into source artifacts. Consequently, auditors flag that too. For example, Secrets Manager would also work. However, among the given choices, only KMS-encrypted variables satisfy the constraint.
Question 7: Preventing a Serverless Consumer from Overwhelming a Database
Midway through this set, the SRE team at Wingtip Toys has an SQS-triggered Lambda function that scales aggressively. During bursts it saturates a DynamoDB table and causes throttling errors elsewhere. The team wants to cap how many concurrent Lambda executions can run against this queue, without changing the queue itself. Which setting should they configure?
A) Increase the SQS visibility timeout to 12 hours
B) Set reserved concurrency on the Lambda function
C) Enable Lambda SnapStart for the runtime
D) Switch the queue to FIFO with a group ID of “default”
Reveal Answer
Correct Answer: B
Explanation: Reserved concurrency both guarantees and caps simultaneous executions. Specifically, that is the throttle-protection lever needed here. In contrast, visibility timeout controls redelivery, not parallelism. Similarly, SnapStart addresses cold starts, not throughput. A FIFO switch would serialize by group. However, it is a much larger architectural change. Moreover, it does not directly cap Lambda concurrency. Therefore, reserved concurrency is the smallest safe change that solves the downstream saturation.
Question 8: Canary Deployment with Weighted Traffic
Adventure Works is preparing to release a risky change to a payments Lambda function. The team wants to shift 10% of production traffic to the new version and keep 90% on the previous version, with the ability to roll back instantly. Which mechanism should they use?
A) Publish the new code as $LATEST and update clients later
B) Create two API Gateway stages and manually split DNS
C) Use a Lambda alias with a weighted routing configuration pointing at both versions
D) Deploy the new code to a second Lambda function and rewrite the invoker
Reveal Answer
Correct Answer: C
Explanation: Aliases with routing configuration natively split traffic between two published versions by weight. In addition, rolling back is a one-line change to shift the weight to 100/0. In contrast, $LATEST is mutable and provides no version pinning. Meanwhile, manual DNS splitting across API Gateway stages is fragile. Furthermore, it adds moving parts. A second function forces client-side changes. Consequently, it doubles operational surface area. Therefore, the alias-based approach is the standard AWS Lambda serverless canary pattern.
Question 9: Least-Privilege Access to DynamoDB
Continuing this review, a payments Lambda function needs to read and write a single DynamoDB table in the same account. The team follows least-privilege and wants no long-lived credentials in code or environment variables. What is the correct approach?
A) Store an IAM access key in an environment variable and use the AWS SDK
B) Create an IAM user, then paste its keys into AWS Secrets Manager
C) Attach an execution role to the function with a policy scoped to the specific table ARN
D) Grant the DynamoDB table a resource-based policy that trusts anonymous callers
Reveal Answer
Correct Answer: C
Explanation: Lambda functions automatically assume an execution role. As a result, they receive short-lived credentials that the SDK picks up without any code changes. Moreover, scoping the policy to a specific table ARN with only required actions satisfies least-privilege. In contrast, access keys in environment variables are long-lived credentials. Therefore, they violate the constraint. Similarly, storing user keys in Secrets Manager still leaves long-lived IAM users. Furthermore, anonymous resource-based access on DynamoDB is unsafe. In most cases, it is not even supported. Ultimately, an execution role is the AWS-native answer.
Question 10: Shared Reference Data Larger Than Ephemeral Storage
Tailwind Traders is deploying multiple Lambda functions that each need to load a shared 15 GB machine-learning reference dataset. Downloading it on every cold start is too slow and expensive. The team wants a single durable copy that all functions can mount and read. Which storage option should they use?
A) Configure /tmp ephemeral storage at the maximum size for each function
B) Attach an Amazon EFS access point to each function
C) Bundle the dataset into the deployment ZIP for every function
D) Copy the dataset to an Amazon EBS volume shared across functions
Reveal Answer
Correct Answer: B
Explanation: Amazon EFS is a shared POSIX file system that Lambda mounts through access points. Furthermore, it easily holds far more than 10 GB and is visible to many functions at once. In contrast, ephemeral /tmp maxes at 10 GB and is per-execution environment, not shared. Deployment ZIPs are capped at 250 MB unzipped. Therefore, a 15 GB dataset will not fit. Meanwhile, EBS is single-attach block storage tied to EC2. Consequently, it cannot be mounted from Lambda. In addition, EFS remains durable across cold starts, which removes the download-per-start problem entirely.
Study Tips for This AWS Lambda Serverless Set
Use these tips to lock in the reasoning patterns behind every AWS Lambda serverless question you will see on the DVA-C02 exam.
- When a scenario says “pay only for what runs” or “scale to zero,” Lambda is almost always right; specifically, watch for Fargate or EC2 distractors with fixed capacity.
- Learn the four cold-start levers by heart: SnapStart for Java, provisioned concurrency for guaranteed warmth, package trimming for Init time, and language choice as a last resort.
- Remember the hard limits — 15-minute timeout, 10 GB ephemeral /tmp, 10 GB memory, 250 MB unzipped ZIP — because most trick answers work only if you forget one of them.
- Distinguish reserved concurrency (a cap and a guarantee) from provisioned concurrency (pre-warmed instances). Exam writers love to swap these two terms.
- For async work, know Destinations (both success and failure paths) versus DLQ (failure only), and choose Destinations whenever a success target appears in the requirements.
Keep Practicing AWS Lambda Serverless Design
Master AWS Lambda serverless patterns and you will unlock a big chunk of the DVA-C02 exam and a good portion of SAA-C03 too. Practice by rewriting each scenario in your own words and predicting the constraint before you look at the answers. For deeper reference, the AWS Lambda Developer Guide is the source of truth for every service limit and feature covered above.
When you are ready for more practice, try these related sets on cloudtech.how: SAA-C03 Question 37 on event-driven Lambda, SAA-C03 Question 48 comparing Lambda vs EC2 cost, and SAA-C03 Question 41 on RDS Proxy for Lambda. Meanwhile, save this post — the next set in this series will pick up at Questions 11-20 with a focus on API Gateway integrations and event source mappings.
