DVA-C02 Practice Test 18 — 15 Questions

Question 1

A company uses AWS CodeDeploy to deploy a web application to an Auto Scaling group. The deployment fails with the error 'The overall deployment failed because too many individual instances failed deployment'. The deployment configuration is set to CodeDeployDefault.OneAtATime. What is the most likely cause of this failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The deployment failed on a single instance, causing the overall deployment to fail because the minimum number of healthy hosts was not maintained.. CodeDeployDefault.OneAtATime deploys to one instance at a time. The deployment stops immediately if a single instance fails, because the deployment configuration expects no failures. The error 'too many individual instances failed' is triggered by that single failure, since the deployment cannot proceed to the next instance without violating the minimum healthy hosts requirement, which is set to maintain availability.

Answer

The instances in the Auto Scaling group are not running a supported operating system.

Answer

The deployment configuration should be changed to AllAtOnce to avoid this error.

Answer

The IAM role for CodeDeploy does not have sufficient permissions.

Question 2

A developer needs to grant cross-account access to an S3 bucket for an IAM user from another AWS account. The developer has added a bucket policy that allows the user's ARN. However, the user still cannot access the bucket. What additional step is required?

Accepted Answer

The user must have an IAM policy allowing the required S3 actions on that bucket. A is correct because cross-account access to an S3 bucket requires both a resource-based policy (the bucket policy) that grants access to the user's ARN and an identity-based policy (an IAM policy attached to the user) that explicitly allows the required S3 actions on that bucket. Without the IAM policy, the user's account denies the request by default, even if the bucket policy permits it. This is the principle of 'permission delegation' in AWS: the resource owner can grant access, but the user's own account must also authorize the action.

Answer

The bucket must be made public

Answer

The user must use a different AWS CLI profile

Answer

The resource-based policy must explicitly allow the user's ARN

Question 3

A company manages multiple AWS accounts using AWS Organizations. A developer needs to allow an IAM role in the production account to read objects from an S3 bucket in the development account. The bucket is encrypted with an AWS KMS customer managed key (CMK) in the development account. Which of the following is required to enable this cross-account access?

Accepted Answer

Add a bucket policy allowing the production account's IAM role and a KMS key policy granting the same role.. Cross-account access to an S3 bucket encrypted with a KMS customer managed key requires both a bucket policy that grants the production account's IAM role s3:GetObject permission and a KMS key policy that grants the same role kms:Decrypt permission. The bucket policy authorizes the S3 operation, while the key policy authorizes decryption of the object; both policies must explicitly allow the cross-account principal.

Answer

Grant the production account's root user access to the KMS key and the S3 bucket.

Answer

Create an IAM role in the production account with permissions to access the S3 bucket and KMS key.

Answer

Enable S3 bucket logging to allow cross-account access.

Question 4

A developer is storing an API secret for a third-party service in AWS Secrets Manager. The secret needs to be accessed by an AWS Lambda function that runs in a VPC. The Lambda function must have the minimum required permissions. Which IAM policy statement should the developer attach to the Lambda execution role?

Accepted Answer

A policy that grants secretsmanager:GetSecretValue for the specific secret ARN and includes a condition for aws:SourceVpce to restrict access to the VPC endpoint. It grants the minimum required permission (secretsmanager:GetSecretValue) scoped to the specific secret ARN, and uses the aws:SourceVpce condition key to restrict access to the VPC endpoint used by the Lambda function. This ensures that only requests originating from the specified VPC endpoint can retrieve the secret, aligning with the principle of least privilege and the requirement that the Lambda function runs in a VPC.

Answer

A policy that grants secretsmanager:GetSecretValue for all secrets in the account

Answer

A policy that grants secretsmanager:GetSecretValue for the secret and includes a condition for aws:SourceIp

Answer

A policy that grants secretsmanager:GetSecretValue for the secret and includes a condition for ec2:Vpc

Question 5

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role's trust policy allows the EC2 service, and the permissions policy grants s3:GetObject on the bucket. The application on the instance receives 'Access Denied' errors when trying to read objects. What is the most likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the IAM role.. The most likely cause is that the EC2 instance does not have an instance profile associated with the IAM role. An IAM role must be attached to an EC2 instance via an instance profile, which acts as a container for the role. Without this association, the instance cannot obtain temporary credentials from the AWS Security Token Service (STS) to sign API requests, resulting in 'Access Denied' errors even if the role's trust and permissions policies are correctly configured.

Answer

The IAM role's trust policy does not allow the EC2 service.

Answer

The S3 bucket has default encryption enabled.

Answer

The S3 bucket policy explicitly denies s3:GetObject.

Question 6

A company uses AWS KMS to encrypt data in Amazon S3. They have a Customer Master Key (CMK) with key rotation enabled. The S3 bucket has default encryption using SSE-KMS with this CMK. An application writes objects to the bucket. Which statement about the encryption is correct?

Accepted Answer

The CMK is used to generate a data key that encrypts the object, and the encrypted data key is stored with the object.. AWS KMS uses envelope encryption: when an object is written to S3 with SSE-KMS, KMS generates a unique data key from the CMK, encrypts the object with that data key, and then stores the encrypted data key alongside the object in S3. The CMK itself never directly encrypts the object data; it only encrypts the data key. This ensures that the CMK can be rotated without affecting the encrypted objects, as the encrypted data key remains decryptable by the new key material if the key ID is the same.

Answer

The CMK directly encrypts the object data.

Answer

When the CMK is rotated, all existing objects in the bucket are automatically re-encrypted with the new key.

Answer

Each object is encrypted with a unique data key that is stored alongside the object.

Question 7

A developer needs to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. Which approach is the most secure?

Accepted Answer

Add a bucket policy in Account A that grants access to the user in Account B, and attach an IAM policy to the user in Account B allowing the S3 actions.. The most secure because it combines a resource-based bucket policy in Account A that explicitly grants access to the user in Account B with an identity-based IAM policy attached to that user in Account B. This dual-policy approach ensures that the user can only access the bucket when both policies allow the action, following the principle of least privilege and avoiding the need to share long-term credentials.

Answer

Create an IAM role in Account A with a trust policy allowing the user from Account B to assume it.

Answer

Share the access keys of an IAM user in Account A with the user in Account B.

Answer

Attach an IAM policy to the user in Account B that grants access to the S3 bucket.

Question 8

A developer is building a serverless application using AWS Lambda. The function needs to access an S3 bucket to read a configuration file. What is the best way to provide the Lambda function with the bucket name?

Accepted Answer

Store the bucket name in an environment variable for the Lambda function.. AWS Lambda environment variables provide a secure, configurable, and decoupled way to pass the S3 bucket name to the function without hardcoding it in the code. This follows the principle of infrastructure as code and allows the same function code to be reused across different environments (e.g., dev, staging, prod) by simply changing the environment variable value. Environment variables are encrypted at rest by default using AWS KMS, ensuring the bucket name is not exposed in plaintext within the code repository.

Answer

Hardcode the bucket name in the Lambda function code.

Answer

Read the bucket name from a text file stored in the same bucket.

Answer

Use a KMS key to encrypt the bucket name and decrypt it in the function.

Question 9

A developer is building a web application that requires user authentication. The application will run on Amazon EC2 instances behind an Application Load Balancer. The developer wants to offload authentication to a managed service that supports social login providers. Which AWS service should the developer use?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct choice because it is a fully managed identity service designed for web and mobile applications, providing user authentication, authorization, and support for social login providers (e.g., Google, Facebook, Amazon) via OAuth 2.0 and OpenID Connect. It offloads the entire authentication workflow from the EC2 instances and ALB, integrating seamlessly with the ALB's authentication action to validate tokens before traffic reaches the application.

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Directory Service

Answer

AWS Single Sign-On

Question 10

A company is building a RESTful API using Amazon API Gateway and AWS Lambda. The API must allow users to authenticate using an identity provider that supports OpenID Connect (OIDC). The developer wants to offload authentication and authorization to API Gateway. Which API Gateway feature should the developer use?

Accepted Answer

Native JWT authorizer (HTTP API). The Native JWT authorizer for HTTP APIs in API Gateway directly validates JSON Web Tokens (JWTs) from an OIDC-compliant identity provider without requiring custom code. This offloads both authentication and authorization to API Gateway by configuring the issuer URL and audience, matching the requirement to use an OIDC provider.

Answer

Amazon Cognito User Pools authorizer

Answer

Custom Lambda authorizer

Answer

AWS IAM authorizer

Question 11

A developer wants to enforce that all requests to an Amazon S3 bucket must use HTTPS (TLS). The bucket is used for static website hosting. Which bucket policy condition should be used to deny requests that do not use HTTPS?

Accepted Answer

"aws:SecureTransport": "false". The `aws:SecureTransport` condition key evaluates to `false` when the request is not sent over HTTPS (TLS). By using a Deny effect with this condition set to `false`, the policy blocks any HTTP requests to the S3 bucket, ensuring all traffic uses encrypted connections. This is a standard approach for enforcing TLS on S3 buckets, including those used for static website hosting.

Answer

"aws:SecureTransport": "true"

Answer

"aws:SourceVpc": "true"

Answer

"aws:Referer": "https"

Question 12

A developer is designing an application that will process credit card payments and store them temporarily in an Amazon DynamoDB table. The developer must ensure that the payment data is encrypted at rest and that the encryption key is managed by the company's security team using AWS KMS. Which type of encryption should the developer enable on the DynamoDB table?

Accepted Answer

Server-side encryption with a customer-managed KMS key. The requirement specifies that the encryption key must be managed by the company's security team. Server-side encryption (SSE) with a customer-managed KMS key allows the company to create, rotate, and control access to the KMS key used to encrypt the DynamoDB table at rest. This gives the security team full control over the encryption key lifecycle, meeting the stated requirement.

Answer

Server-side encryption with an AWS managed KMS key

Answer

Client-side encryption

Answer

Static key encryption

Question 13

A developer is writing an AWS Lambda function that processes files uploaded to an S3 bucket. The function should only be triggered when a new object is created in a specific subfolder (e.g., /uploads/). Which S3 event notification configuration should the developer use?

Accepted Answer

Configure the event notification with a prefix filter set to 'uploads/' and event type 's3:ObjectCreated:*'.. S3 event notifications support prefix filtering, which allows you to specify a key prefix (e.g., 'uploads/') so that only object creation events in that subfolder trigger the Lambda function. By setting the event type to 's3:ObjectCreated:*', the function responds to all object creation operations (PUT, POST, Copy, etc.) within the filtered path, meeting the requirement precisely without unnecessary invocations.

Answer

Configure a single event notification for all objects and filter on the prefix inside the Lambda function.

Answer

Configure the event notification using object tags to filter events.

Answer

Use AWS CloudTrail to detect S3 PutObject events and trigger Lambda.

Question 14

A company stores sensitive documents in an Amazon S3 bucket. The security team requires that all objects uploaded must be encrypted at rest using a specific customer-managed AWS KMS key (key-id: 1234-5678). The developer must enforce this by denying any PutObject request that does not use the correct key. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id with value 'arn:aws:kms:us-east-1:123456789012:key/1234-5678'. The condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` allows you to enforce that a specific customer-managed AWS KMS key (identified by its full ARN) is used for server-side encryption. By denying PutObject requests that do not match this key ID, the security team ensures all uploaded objects are encrypted at rest with the required KMS key.

Answer

s3:x-amz-server-side-encryption with value 'aws:kms'

Answer

s3:x-amz-acl with value 'bucket-owner-full-control'

Answer

aws:SourceArn with value the bucket ARN

Question 15

A company requires that all data in Amazon S3 be encrypted at rest using server-side encryption with a customer-managed KMS key. The developer needs to ensure that any object uploaded without the x-amz-server-side-encryption header set to aws:kms is denied. How can this be enforced?

Accepted Answer

Use a bucket policy that denies s3:PutObject if the encryption condition is not met.. An S3 bucket policy with a condition that denies s3:PutObject unless the `s3:x-amz-server-side-encryption` header equals `aws:kms` enforces server-side encryption with a customer-managed KMS key at the API level. This policy explicitly rejects any upload that does not include the required encryption header, ensuring compliance even if default encryption is bypassed or misconfigured.

Answer

Configure default encryption on the bucket with SSE-KMS.

Answer

Enable S3 Object Lock.

Answer

Use a CloudTrail trail to monitor uploads.