Lesson 1: Exam Briefing, AWS CLI, SDKs and CloudShell

Before we start: what this course is

This course is independent of AWS. It is not endorsed by Amazon Web Services, its practice questions are original and are not real exam questions, and it does not promise a pass. What it does is follow the official DVA-C02 exam guide (version 2.1) skill by skill, the way a senior engineer would walk a colleague through it.

The exam in numbers

Three details change how you should sit the exam:

• Unscored questions are not identified. AWS uses them to trial future questions. You cannot spot them, so treat every question as if it counts.
• Unanswered questions are scored as incorrect, and there is no penalty for guessing. A blank earns nothing; a guess on a four-option question has a 1-in-4 chance. Never leave a blank.
• Scoring is compensatory. You do not need to pass each section, only the exam overall. A weak domain can be offset by a strong one.

Gotcha: 720 is a scaled score, not "72% correct". Scaling evens out exam forms of slightly different difficulty, so don't try to convert it into a number of questions.

The four domains

Development and Security together are 58% of your score. Study time should follow the weightings.

How to take a scenario question apart

Most questions are short stories. Read them like a bug ticket and pull out three things:

1. Requirement: what must be achieved.
2. Constraint: what you may not change or must respect.
3. Qualifier: the phrase that decides between two answers that would both work, such as "least operational overhead" or "MOST cost-effective".

Worked example:

A developer needs to run a few AWS CLI commands against a test account from a borrowed laptop. The developer must not store long-term credentials on the laptop. Which solution has the LEAST operational overhead?

• Requirement: run AWS CLI commands.
• Constraint: no long-term credentials on the machine.
• Qualifier: least operational overhead.

Now eliminate in this order: first strike options that fail the requirement, then those that break the constraint (installing the CLI and running aws configure with access keys), then use the qualifier to choose between the survivors (launching an EC2 instance to work from is valid but is more to manage). What remains is AWS CloudShell.

The exam guide describes distractors as plausible responses that a candidate with incomplete knowledge might choose. Expect wrong answers that are real services doing real things, just not what this scenario asks for.

Three ways to call AWS

Everything in AWS is an API call. The Management Console, the AWS CLI and the AWS SDKs are different front ends to the same service APIs.

• AWS CLI: one terminal command per API call. Ideal for scripts and quick checks.
• AWS SDKs: the same calls as library functions in your language (for example the AWS SDK for Python, Boto3).
• AWS CloudShell: a browser-based, pre-authenticated shell that you launch from the AWS Management Console. AWS CLI version 2 is pre-installed, and the credentials you signed in to the console with are forwarded to it.

Walkthrough: your first command in CloudShell

Open CloudShell from the console, then ask AWS "who am I?":

# Calls the AWS STS GetCallerIdentity API.
# The safest first command: it changes nothing and proves your credentials work.
aws sts get-caller-identity

{
    "UserId": "AIDA1111111111EXAMPLE",
    "Account": "123456789012",
    "Arn": "arn:aws:iam::123456789012:user/dev-anna"
}

Every CLI command has the same shape: aws <service> <operation> [options].

# Same call, different presentation: --output only changes what you see
aws sts get-caller-identity --output table

# CloudShell sets the default Region through the AWS_REGION environment variable
echo $AWS_REGION

# Override the Region for this one command
aws dynamodb list-tables --region eu-west-1

CloudShell gives you up to 1 GB of persistent storage per AWS Region in your home directory, so scripts saved there survive between sessions.

Profiles, Regions and output formats

On your own machine nothing is pre-authenticated. The CLI and the SDKs read two shared files in ~/.aws/ (on Windows, C:\Users\USERNAME\.aws\):

# ~/.aws/config  -- settings
[default]
region = us-east-1
output = json

[profile dev]          # named profiles need the word "profile" here
region = eu-west-1
output = table

# ~/.aws/credentials  -- secrets only
[dev]                  # ...but NOT here: just the profile name
aws_access_key_id = AKIAIOSFODNN7EXAMPLE
aws_secret_access_key = wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY

A named profile is a labelled bundle of settings. Pick one per command or per session:

aws s3 ls --profile dev        # this command only
export AWS_PROFILE=dev         # every command (and SDK call) in this shell

The SDKs read the same files, so the same profile works in code:

import boto3

session = boto3.Session(profile_name="dev")   # same [profile dev] the CLI uses
print(session.client("sts").get_caller_identity()["Account"])

When a setting is defined in several places, the most specific wins:

1. Command line options (--region, --output, --profile)
2. Environment variables (AWS_REGION, AWS_DEFAULT_OUTPUT, AWS_PROFILE)
3. The config file

The CLI's output formats are json (the default), yaml, yaml-stream, text, table and off. Use json for programs, text for piping into grep or awk, and table for human eyes.

Gotcha: most resources live in one Region. "My table has disappeared" is very often a call sent to the wrong Region, so check --region, then AWS_REGION, then the profile.

Best practice: on a server shared by several applications, AWS recommends named profiles over [default], because every AWS tool on the machine picks up the default profile automatically.

What the exam asks about this

• Expect to be asked what a tool is for, not to recite syntax: CloudShell appears as the answer when a scenario wants CLI access with no installation and no stored credentials.
• Know the precedence chain. "The command went to the wrong Region although the profile is correct" usually points to an environment variable or a --region option overriding the config file.
• The exam uses short service names such as Amazon SNS, and the Help feature on every question lists the full names.
• Qualifiers decide the answer. Read the last sentence of the question twice.

Key takeaways

• 65 questions (50 scored, 15 unscored and unmarked), 130 minutes, pass at a scaled 720 of 1,000.
• No penalty for guessing and blanks are scored as incorrect: answer everything.
• Compensatory scoring: only the overall result matters. Domains weigh 32%, 26%, 24% and 18%.
• Dissect each scenario into requirement, constraint and qualifier, and eliminate in that order.
• CloudShell is a pre-authenticated browser shell with AWS CLI version 2 installed.
• Profile, Region and output format shape every call; command line beats environment variable beats config file.
• This course is independent of AWS and promises no pass.