Amazon DVA-C02: Serverless & AWS Lambda — Study Guide
Part of the AWS Developer Associate DVA-C02 — Study Guide. Practice with verified answers in the Amazon exam hub, or take timed practice tests on ExamRoll.io.
Versions, aliases, layers, and packaging
Lambda versions are immutable snapshots of code and configuration created with the PublishVersion API (for example, boto3.client(’lambda’).publish_version(FunctionName=‘MyFunc’)). Use versions to provide reproducible releases and then create aliases (boto3.client(’lambda’).create_alias or update_alias) as stable pointers that can also carry a routing configuration to split traffic between versions for gradual rollouts. Layers provide a way to share common native libraries or runtime packages; publish_layer_version lets you attach dependencies (e.g., compiled binaries) separate from your function package so builds are smaller and cold starts are faster. For packaging, prefer small zip archives for quick deploys (or S3-backed uploads for larger artifacts) and adopt container images when you need sizable binaries or custom runtimes; docker build + aws lambda create-function –package-type Image will register images stored in ECR (container images support much larger sizes). Common traps include baking credentials into environment variables, exceeding deployment-package size limits, and forgetting that layers are versioned and immutable: update dependencies by publishing a new layer version and updating function configuration. For programmatic rollbacks, update the alias to point to a previous version (boto3.client(’lambda’).update_alias(FunctionName=‘MyFunc’, Name=‘prod’, FunctionVersion=‘3’)) to minimize operational impact.
Execution environment, performance tuning, and cold-start mitigation
Lambda CPU scales with memory, so improving CPU-bound workloads is typically done by increasing the MemorySize setting (via UpdateFunctionConfiguration) rather than changing a separate CPU knob; measure with AWS X-Ray and CloudWatch metrics to find the sweet spot between duration and cost. Cold starts are influenced by package size, initialization code, use of VPC networking (ENI attachment latency), and language runtime; mitigate by trimming initialization, moving heavy libraries into layers, using Provisioned Concurrency (put_provisioned_concurrency_config), or using container images with optimized entrypoints. For VPC-attached functions, avoid cold-start spikes by using VPC endpoints for S3/DynamoDB or RDS Proxy to limit connection churn and NAT Gateway costs; ensure the Lambda execution role includes the AWSLambdaVPCAccessExecutionRole managed policy and that subnets have adequate IP address space for ENIs. Be aware of traps such as synchronous timeouts: set the function timeout lower than downstream dependencies to ensure outbound callers see a consistent failure model, and use idempotency tokens for retries because services like SQS, SNS, and Kinesis deliver at-least-once semantics.
VPC access, ephemeral storage, and security controls
When you place a Lambda in a VPC, you must configure subnet IDs and security groups on the function configuration; the function then uses ENIs in those subnets and needs network paths to external services. To reach S3 or DynamoDB without NAT, create VPC endpoints (Gateway for S3, Interface endpoints for many services). For databases, prefer RDS Proxy to pool connections and reduce bursty connection creation. The /tmp directory provides ephemeral storage for the execution environment and is writable during invocation; configure larger ephemeral storage if needed (EphemeralStorage setting) but design for stateless functions when possible. Secure secrets by storing them in AWS Secrets Manager or Parameter Store (SSM) and granting the Lambda role least privilege; fetch secrets at cold start using boto3.client(‘secretsmanager’).get_secret_value(SecretId=arn) or use environment variables encrypted with a KMS key specified in the function’s KMSKeyArn. Common developer pitfalls include missing VPC endpoints leading to timeouts, embedding plaintext keys in code, and forgetting to rotate or cache secrets efficiently to avoid throttling Secrets Manager API calls.
Event integrations, error handling, local testing, and deployment strategies
Lambda integrates natively with many event sources: S3 event notifications, DynamoDB Streams, Kinesis, SQS, and API Gateway. For stream sources, tune the batch size and parallelizationFactor, monitor IteratorAge, and handle partial failures since Lambda will retry failed batches and can block downstream processing when errors persist. For asynchronous invocations use DLQs or Destinations to capture failures (configure asynchronous invocation with onFailure/onSuccess destinations). S3-triggered functions must guard against recursive invokes when you write back to the same bucket by checking object keys or using object tags. Local testing is best done with the AWS SAM CLI (sam build; sam local invoke; sam local start-api) or containerized Lambda runtimes; unit tests can use moto or local mocking, but integration tests should run against real AWS resources in ephemeral test accounts. Deployments should use versioned functions + aliases and traffic shifting through CodeDeploy or UpdateAlias with a RoutingConfig to perform canary or linear deployments; implement PreTraffic and PostTraffic hooks for verification. Typical traps are ignoring idempotency for retries, not handling partial BatchGetItem responses (check UnprocessedKeys), and using overly broad IAM roles for execution.
Practical Problem: Use-Case Scenario
Scenario: PhotoSpot Inc runs a Python Lambda that processes images uploaded to S3, writes metadata to DynamoDB, and calls a third-party image-optimization API. The function needs fast cold-start performance, secure API credentials, safe rollbacks, and access to a VPC-hosted RDS proxy for metadata enrichment.
Challenge: Reduce cold-start latency for user-visible uploads, protect and rotate the third-party API key, and enable zero-downtime safe rollbacks and controlled traffic shifting.
Recommended Approach:
- Build and publish immutable releases: use the AWS CLI or boto3 to update code, then boto3.client(’lambda’).publish_version(FunctionName=‘PhotoProcessor’) and create/update alias boto3.client(’lambda’).update_alias(FunctionName=‘PhotoProcessor’, Name=‘prod’, FunctionVersion=‘7’, RoutingConfig={‘AdditionalVersionWeights’: {‘8’: 0.1}}).
- Mitigate cold starts: configure Provisioned Concurrency for the alias boto3.client(’lambda’).put_provisioned_concurrency_config(FunctionName=‘PhotoProcessor’, Qualifier=‘prod’, ProvisionedConcurrentExecutions=10) and move heavy native libs into a published layer (boto3.client(’lambda’).publish_layer_version).
- Secure credentials: store the third-party API key in AWS Secrets Manager, grant the Lambda role least-privilege, and fetch at cold start with boto3.client(‘secretsmanager’).get_secret_value(SecretId=secret_arn) rather than embedding secrets in code or plain env vars.
- VPC and connection handling: place the function in private subnets with security groups, use RDS Proxy for DB access to avoid connection storms, and create a VPC endpoint for S3 so image reads do not require NAT.
Rationale: Using versions and aliases with traffic shifting enables safe rollouts and immediate rollback by repointing an alias. Provisioned Concurrency and layers reduce initialization latency while Secrets Manager centralizes credential rotation and minimizes secret exposure. RDS Proxy and VPC endpoints lower latency and operational cost by reducing connection churn and NAT dependency.
All domains · Amazon API Gateway →
Practice these questions → · Timed practice on ExamRoll.io →
Pass the whole exam — not just this question
You found this answer. Get every verified question and explanation in one place, and save hours of prep. Free to start.
Pass your exam →