DVA-C02 Exam Preparation Material | AWS Certified Developer - Associate

Explanation:
The correct answer is C because AWS AppConfig feature flags support variants and targeting rules, which allow developers to enable different feature behavior for different audiences with minimal custom code. In this scenario, the requirement is to enable a premium feature only for a specific group of users identified by their user IDs. AppConfig can handle this directly by defining multiple flag variants and applying rules that target the intended users.
This is the solution with the least development effort because the targeting logic is managed in AppConfig instead of being implemented and maintained in the application code. AWS documentation for AppConfig feature flags emphasizes dynamic control of feature rollout, audience targeting, and safe configuration management. By configuring the targeting rules centrally, the developer can change which users receive the premium feature without redeploying the application.
Option A is less desirable because it pushes the user ID evaluation logic into the application, increasing development and maintenance effort.
Option B is more cumbersome because creating separate feature flags for every user group does not scale well and adds administrative overhead.
Option D is not the intended AppConfig pattern and introduces unnecessary complexity by requiring an external database lookup during flag evaluation.
Using one feature flag with multiple variants and targeting rules is the cleanest and most AWS-native design for selective rollout to a defined user segment. It keeps the configuration centralized, reduces code changes, and supports flexible future updates.
Therefore, the best solution is C.

Explanation:
S3Bucket and S3Key: These properties in a CloudFormation AWS: : Lambda: : Function resource specify the location of the function's code in S3.
Least Development Effort: This solution minimizes code changes, relying on CloudFormation to reference the existing S3 deployment package.
Reference:
AWS: : Lambda: : Function
Resource https: //docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-lambda-function.html

Explanation:
AWS Secrets Manager is specifically designed for sensitive information like database credentials. It supports automatic rotation and cross-account access. Using the "AWS Parameters and Secrets Lambda Extension" is the modern, high-performance way to retrieve secrets. It caches the secret locally in the Lambda execution environment, reducing latency and cost (API call volume) while ensuring the credentials are not stored in plaintext in environment variables or source code.

Explanation:
The business rule requires controlled sequencing: inventory must determine which order gets the seat before payment is processed. Running inventory and payment in parallel is unsafe because the payment Lambda could charge an order that later loses the seat. A standard SNS topic or a shared SQS queue does not enforce the required business sequence between inventory reservation and payment processing. An SNS FIFO fanout can preserve message order to SQS FIFO queues, but it still sends events to separate inventory and payment workflows, which does not guarantee that payment waits for inventory decision and fallback logic. Initiating inventory first and payment second is the only option that directly enforces the required order. For a production-grade design, Step Functions would be even cleaner, but it is not offered.

Explanation:
This solution is the most efficient method to grant users access to AWS resources without requiring them to log in. Amazon Cognito is a service that provides user sign-up, sign-in, and access control for web and mobile applications. Amazon Cognito identity pools support both authenticated and unauthenticated users. Unauthenticated users receive access to your AWS resources even if they aren’t logged in with any of your identity providers (IdPs). You can use Amazon Cognito to associate unauthenticated users with an IAM role that has limited access to resources, such as Amazon S3 buckets or DynamoDB tables. This degree of access is useful to display content to users before they log in or to allow them to perform certain actions without signing up. Using an identity provider to securely authenticate with the application will require users to log in, which does not meet the requirement. Creating an AWS Lambda function to create an IAM user when a user accesses the application will incur unnecessary costs and complexity, and may pose security risks if not implemented properly. Creating credentials using AWS KMS and applying them to users when using the application will also incur unnecessary costs and complexity, and may not provide fine-grained access control for resources.
Reference: Switching unauthenticated users to authenticated users (identity pools), Allow user access to your API without authentication (Anonymous user access)