SaveMyCert
Guide

DVA-C03 study plan: the new Developer exam

By the SaveMyCert Editorial TeamPublished Updated

To study for DVA-C03, work through its four domains with daily scenario practice, give the new material its own pass (AI-assisted development, the security of AI services and agents, container images and deployments, and presigned URLs), build the core services yourself in an AWS account, and finish with full-length timed mocks until you clear the pass mark consistently. DVA-C03 is the new version of the AWS Certified Developer – Associate exam. Registration opens on 1 December 2026, and the last day to sit DVA-C02 is 30 November 2026. The exam is written around scenarios a working developer meets, so the plan puts as much weight on judging between workable options as on knowing what each service does.

What DVA-C03 tests, and what it leaves out

DVA-C03 tests whether you can develop, test, deploy and debug applications on AWS, including with AI-assisted development tools. AWS describes the target candidate as someone with a year or more of hands-on experience developing and maintaining applications on AWS, who is proficient in at least one high-level programming language and familiar with AI-assisted development workflows. The four domains are Development with AWS Services, Security, Testing and Deployment, and Troubleshooting and Optimization.

The exam guide also lists job tasks the candidate is not expected to perform, and they are worth reading before you buy any extra material. Designing architectures, designing and creating CI/CD pipelines, administering IAM users and groups, selecting foundation models, engineering prompts, designing RAG architectures, and designing AI safety frameworks and AI governance are all out of scope. Amazon SageMaker AI and Strands Agents are on the out-of-scope service list. In practice this means you study AI as a developer who calls a managed service and has to secure the call, not as someone who trains or chooses models.

One line in that list needs care: implementing guardrails appears among the out-of-scope tasks, while Task 2.3 expects you to filter and control model inputs and outputs with content filtering, sensitive information detection, denied topics and prompt-injection protection. A reasonable reading is that you will not be asked to design a safety programme, but you should recognise which control handles which risk when your code sends data to a model.

Phase 1 — Orient and take a baseline (a day or two)

Start by reading the DVA-C03 exam guide end to end, including the in-scope service list, then answer a short practice session cold. The result tells you whether your gap is coverage (services you have never touched) or judgment (you know the services but pick the wrong option under a constraint), and those need different fixes.

Most developers are strong in the parts of the syllabus their own codebase uses and weak in the parts a platform or security team owns. For DVA-C03 that weak half often includes the new material: Amazon Bedrock, Bedrock AgentCore, Kiro and the AI-security task. Pick a target exam window on or after 1 December 2026 now, and let the size of your weak half set how long the plan runs.

Phase 2 — Work through the four domains (the bulk of the plan)

Study one domain at a time, starting with Development with AWS Services, which carries the most weight and underpins the rest. Read each lesson, then practise on the same topic and read the explanation for every option, including the ones you rejected. In a developer exam the wrong options are usually real configurations that fail on one detail, such as the wrong retry behaviour or a key that will not scale.

  • Development with AWS Services: decoupling with SQS, SNS and EventBridge, synchronous versus asynchronous calls, retries with backoff, API Gateway request and response handling, SDK calls, streaming and serialization, Lambda configuration, VPC access, destinations and dead-letter queues, data store choice and caching, DynamoDB key, index and consistency design, and the new AI-assisted development and managed AI service skills.
  • Security: identity federation, fine-grained access, programmatic access and assuming roles, presigned URLs through S3 and CloudFront, encryption at rest and in transit with KMS and certificates, masking PII and PHI, secrets management, and the new Task 2.3 on AI services: access, private connectivity through VPC endpoints, input and output filtering, securing agent actions, and keeping sensitive content out of logs.
  • Testing and Deployment: dependencies and configuration with AppConfig, Parameter Store and Secrets Manager, container images in Amazon ECR, API Gateway stages, tests with AWS SAM, AWS CDK and CloudFormation, mock APIs and test events, environments such as Lambda aliases and AWS Copilot environments, ECS task definitions, EKS manifests and Fargate, CodeDeploy and CodePipeline, blue/green, canary and rolling releases, and rollback.
  • Troubleshooting and Optimization: reading metrics, logs and traces, querying logs, diagnosing deployment failures, structured logging, custom metrics, alerts, tracing with X-Ray, health checks and liveness and readiness probes, then concurrency, memory tuning, messaging, caching with ElastiCache, DAX and CloudFront, and finding bottlenecks with CloudWatch.

Phase 3 — Build it yourself in an AWS account

Hands-on work is the fastest way to make the scenarios concrete, and you do it in your own AWS account: SaveMyCert has revision notes, practice questions and mocks, but no hands-on labs. Set a billing alarm first, keep everything small, and delete each stack when you finish with it.

Build a small application that touches each domain, then break it on purpose. Give a function too little memory, remove a permission from its role, push a bad image tag, and watch what the logs and traces show. The exam's troubleshooting questions describe exactly these moments.

  • Lambda and DynamoDB: a function behind API Gateway that reads and writes a table, with an SQS queue and a dead-letter queue for a slow step. Deploy it from an AWS SAM template, then shift traffic to a new version through an alias.
  • DynamoDB design: model one access pattern with a partition and sort key, add a secondary index for a second pattern, and compare a query with a scan on the same data.
  • Containers: write a Dockerfile, push the image to Amazon ECR with a meaningful tag, add a lifecycle policy, and run it as an ECS service on Fargate. Then deploy a second image tag and watch the rolling update.
  • Presigned URLs: generate a time-limited download link for a private S3 object from code, and confirm it stops working once it expires.
  • Amazon Bedrock guardrails: create a guardrail with a content filter, a denied topic and a sensitive information filter, test it in the console test window, then call a model with the guardrail ID and version from code and see what the response looks like when a filter blocks or masks content.

Phase 4 — Rehearse with timed mocks, then book

Once every domain is covered, sit a full-length timed mock in one sitting, then spend longer reviewing it than you spent taking it. Sort each miss into a knowledge gap or a misread constraint, and rebuild practice sessions from your incorrect and flagged questions. Skim the cheat sheet between mocks and reopen any lesson whose takeaways feel unfamiliar.

The exam uses compensatory scoring, so you only need to pass overall, but a domain that trails badly in your mocks is still the cheapest place to find marks. Troubleshooting and Optimization now carries more of the exam than it did on DVA-C02, so do not leave it for last.

  • Two or more consecutive full-length mocks clear the pass mark with margin.
  • No domain clearly trails the others in your per-domain results.
  • You can say, without notes, when to use a presigned URL, a Lambda destination, a dead-letter queue and a VPC endpoint.
  • You can explain which Bedrock guardrail control handles prompt injection, PII in a response and an off-limits topic.

Switching from DVA-C02 preparation

If you started on DVA-C02 and will not sit it by 30 November 2026, keep what you have learned and redirect the rest of your time to the additions. AWS's comparison of the two versions lists additions and reorganisations rather than removals, so Lambda, DynamoDB, API Gateway, IAM, KMS, the CI/CD services and CloudWatch all still count. For the full list of what changed, see the DVA-C02 vs DVA-C03 comparison.

Plan the switch in three steps. First, learn the new material: the AI-security task, AI-assisted development and managed AI services, container images and container deployments, and presigned URLs. Second, relearn where some skills now sit: unit testing with AWS SAM moved into Testing and Deployment, and Lambda performance tuning moved into Troubleshooting and Optimization. Third, rebalance your practice towards troubleshooting and optimization, and check that any older practice bank you keep using covers the new topics, because one written for DVA-C02 will not.

Start studying for DVA-C03 — free
Revision notes, explained practice questions and timed mock exams.

Plan your prep

Questions, answered

Work through the four domains in turn with daily scenario practice, give the new material its own pass (AI-assisted development, AI-service security, containers and presigned URLs), build the core services in your own AWS account, and finish with full-length timed mocks. Book once consecutive mocks clear the pass mark with margin and no domain trails.

Sources

Exam facts in this guide come from the vendor's published exam guide. Vendors revise these — check the source for the current version before you book.

Compare DVA-C03 with another certification