AWS Developer Associate Prep 2 practice questions and answers 2026. Tap an option to test yourself — you'll see the correct answer and a plain-English explanation for every question. Free, no login.
Q21A developer is building a web application that needs to authenticate users against an existing corporate directory. Which AWS service should be used to implement identity federation?
✓ Correct answer: D. Amazon Cognito
Amazon Cognito supports identity federation with external identity providers including SAML, OIDC, Facebook, Google, etc., allowing users to authenticate with existing credentials while accessing AWS resources.
Q22Which of the following is a best practice for securing AWS Lambda environment variables containing sensitive information?
✓ Correct answer: C. Encrypt them using AWS KMS
AWS KMS should be used to encrypt sensitive environment variables in Lambda functions, providing an additional layer of security for sensitive data beyond the default encryption that Lambda provides.
Q23A developer needs to grant an Amazon S3 bucket access to an AWS Lambda function. Which type of policy should be used?
✓ Correct answer: B. Resource-based policy
Resource-based policies are attached directly to the resource (in this case, the S3 bucket) and define who has access to that resource and what actions they can perform.
Q24Which AWS service should be used to securely store and automatically rotate database credentials used by an application?
✓ Correct answer: A. AWS Secrets Manager
AWS Secrets Manager is designed to protect access to applications, services, and IT resources without hardcoding credentials. It offers automatic rotation of secrets for supported services.
Q25A developer is implementing OAuth 2.0 authentication in an application. Which type of token is commonly used to securely transmit authentication information between parties?
✓ Correct answer: D. JWT (JSON Web Token)
JSON Web Tokens (JWT) are an open standard for securely transmitting information between parties as a JSON object. They're commonly used with OAuth 2.0 to represent claims between two parties.
Q26Which AWS service can be used to enforce encryption of data at rest in an Amazon S3 bucket?
✓ Correct answer: C. AWS Key Management Service (KMS)
AWS Key Management Service (KMS) manages encryption keys and integrates with S3 to enforce server-side encryption of objects stored in S3 buckets.
Q27A developer needs to implement fine-grained access control for objects in an Amazon S3 bucket. Which S3 feature should be used?
✓ Correct answer: B. S3 Access Control Lists (ACLs)
Amazon S3 Access Control Lists (ACLs) provide fine-grained control over specific objects within buckets, allowing you to manage permissions at the object level.
Q28Which of the following is a best practice for managing AWS access credentials in a CI/CD pipeline?
✓ Correct answer: A. Use IAM roles for EC2 instances or services running the pipeline
IAM roles provide temporary credentials that automatically rotate, making them more secure than using long-term access keys in CI/CD environments.
Q29When implementing SAML 2.0 federation with AWS, which service acts as the identity provider (IdP)?
✓ Correct answer: D. The external corporate directory system
In a SAML 2.0 federation with AWS, the external corporate directory (like Active Directory or another SAML-compatible identity system) acts as the identity provider, authenticating users and providing assertions to AWS.
Q30A developer needs to secure communication between microservices in an Amazon ECS cluster. Which AWS service should be used?
✓ Correct answer: C. AWS Certificate Manager
AWS Certificate Manager provides, manages, and deploys public and private SSL/TLS certificates for use with AWS services, making it the appropriate choice for securing communication between microservices.
Use the free AWS Developer Associate Prep 2 sample, download the PDF, then unlock web-based timed mock exams for a full exam rehearsal.
Theory