DVA-C02 Practice Exam 1 — 20 Questions

Question 1

A developer is troubleshooting an AWS Lambda function that is triggered by an S3 event. The function occasionally fails with a timeout error. CloudWatch logs show that the timeout occurs during the processing of large files. The function has a memory setting of 128 MB and a timeout of 3 seconds. The developer wants to process large files without modifying the code. Which parameter should the developer adjust first?

Accepted Answer

Increase the function's memory. Increasing the function's memory is the correct first step because Lambda allocates CPU proportionally to memory, and more CPU reduces processing time for CPU-bound tasks like decompressing or parsing large files. This directly addresses the timeout by making the function complete faster, without requiring code changes. The current 128 MB setting is the minimum, which provides the least CPU, so even a modest increase can significantly reduce execution time.

Answer

Increase the function's timeout

Answer

Increase the function's reserved concurrency

Answer

Increase the S3 event notification batch size

Question 2

A developer needs to call AWS APIs from application code running on EC2. Which credential source should the AWS SDK use by default?

Accepted Answer

Temporary credentials from the instance profile role. Option D is correct because the AWS SDK on EC2 automatically retrieves temporary credentials from the instance metadata service (IMDS) at http://169.254.169.254/latest/meta-data/iam/security-credentials/. These credentials are provided by the IAM role attached to the EC2 instance (the instance profile role) and are rotated automatically, eliminating the need to store long-term credentials on the instance.

Answer

Static credentials committed to Git

Answer

A credentials file copied into the AMI

Answer

The root account access key

Question 3

A developer needs to allow an IAM user in a different AWS account to assume a role in the developer's account. The role has permissions to access an S3 bucket. Which policy is required in the developer's account to enable this cross-account access?

Accepted Answer

An IAM role with a trust policy that allows the external account's root user or specific IAM users/roles to assume the role. Option A is correct because cross-account IAM role access requires a trust policy attached to the role in the developer's account. This trust policy specifies the external AWS account ID (or specific IAM users/roles in that account) as the principal, allowing them to call sts:AssumeRole. Once the role is assumed, the developer's account grants the necessary S3 permissions via the role's permissions policy.

Answer

An S3 bucket policy granting access to the external account

Answer

An IAM user policy in the external account allowing sts:AssumeRole

Answer

An AWS Organizations service control policy allowing cross-account access

Question 4

A developer needs to grant an IAM role in Account B read-only access to objects in an S3 bucket in Account A. The bucket is encrypted with server-side encryption using AWS KMS (SSE-KMS) with a customer managed key (CMK) in Account A. Which combination of policies is required for the cross-account access to succeed?

Accepted Answer

The bucket policy in Account A grants s3:GetObject to the role, the KMS key policy grants kms:Decrypt to the role, and the role in Account B has an IAM policy allowing s3:GetObject and kms:Decrypt. Option A is correct because cross-account access to an SSE-KMS encrypted S3 bucket requires three layers of permissions: the bucket policy in Account A must grant s3:GetObject to the IAM role in Account B, the KMS key policy must grant kms:Decrypt to the same role, and the role's IAM policy in Account B must allow both s3:GetObject and kms:Decrypt. Without any one of these, the request will fail due to either an S3 authorization error or a KMS decryption failure.

Answer

The bucket policy in Account A grants s3:GetObject to the role, and the role in Account B has an IAM policy allowing s3:GetObject. No KMS permissions are needed because SSE-KMS uses AWS managed keys by default.

Answer

The bucket policy in Account A grants s3:GetObject to the role, and the KMS key policy grants kms:Decrypt to the role. The role in Account B does not need additional IAM policies because the bucket and key policies provide sufficient permissions.

Answer

Only the bucket policy in Account A needs to grant s3:GetObject to the role. KMS is not involved because the bucket is encrypted with SSE-KMS but the role can decrypt using the default KMS key.

Question 5

An API Gateway HTTP API should allow access only to users authenticated by an external OIDC provider. Which authorizer type is most appropriate?

Accepted Answer

JWT authorizer configured for the issuer and audience. Option C is correct because an HTTP API Gateway with an external OIDC provider requires a JWT authorizer. The JWT authorizer validates the token's signature, issuer, and audience against the OIDC provider's configuration, ensuring only authenticated users gain access. This is the native AWS mechanism for integrating third-party OIDC identity providers like Auth0 or Okta.

Answer

IAM authorizer

Answer

API key authorizer

Answer

S3 bucket policy

Question 6

A developer monitors an AWS Lambda function that processes messages from an Amazon SQS queue. CloudWatch logs show that the function's execution time has increased significantly over the past week, and it now frequently times out at the 5-minute timeout. The function's code has not been changed recently. The function makes calls to an Amazon DynamoDB table. What is the most likely cause of the increased execution time?

Accepted Answer

The DynamoDB table's read capacity units are underprovisioned, causing throttling.. The most likely cause is that the DynamoDB table's read capacity units are underprovisioned, leading to throttling (ProvisionedThroughputExceededException). When DynamoDB throttles requests, the Lambda function must retry them, which adds latency and can cause the function to exceed its 5-minute timeout. Since the code hasn't changed, this points to a scaling or capacity issue on the DynamoDB side.

Answer

The SQS queue's visibility timeout is too short, causing duplicate processing.

Answer

The Lambda function's memory is too low, causing CPU throttling.

Answer

The DynamoDB table's indexes are missing, causing full table scans.

Question 7

A developer needs to allow an EC2 instance to read from a DynamoDB table. Which is the best practice to grant permissions?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance.. The best practice for granting an EC2 instance permissions to access DynamoDB is to create an IAM role with the required permissions and attach it to the instance. This eliminates the need to manage long-term credentials, as the instance automatically retrieves temporary security credentials from the instance metadata service (IMDS) via the AWS Security Token Service (STS). This approach follows the principle of least privilege and ensures credentials are rotated automatically.

Answer

Generate an IAM user access key and store it in the application configuration.

Answer

Hardcode the AWS credentials in the application code.

Answer

Add the DynamoDB table ARN to the EC2 instance's security group.

Question 8

A developer is designing a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party identity provider (IdP). Which TWO services can be used to manage user authentication?

Accepted Answer

Amazon Cognito User Pools. Options A and D are correct. Cognito User Pools can integrate with third-party IdPs. API Gateway can use Lambda authorizers to validate tokens. Option B is wrong because IAM is for AWS users, not external IdPs directly. Option C is wrong because Secrets Manager is for secrets. Option E is wrong because STS is for temporary credentials, not authentication.

Answer

AWS IAM

Answer

AWS Security Token Service (STS)

Answer

AWS Secrets Manager

Question 9

A developer wants to grant a user in a different AWS account access to an S3 bucket. The developer has written a bucket policy that allows the user's IAM user ARN. However, the access is still denied. What is the most likely reason?

Accepted Answer

The user's IAM user policy does not explicitly allow the required S3 action. When granting cross-account access to an S3 bucket, both the bucket policy (resource-based policy) and the user's IAM policy (identity-based policy) must explicitly allow the action. The bucket policy alone is insufficient if the user's IAM policy does not include an explicit Allow for the S3 action, because IAM denies by default. Even though the bucket policy grants access, the user's own IAM policy must also permit the operation for the request to succeed.

Answer

The bucket policy does not have a principal of '*' to allow external accounts

Answer

The bucket is in a different region than the user's account

Answer

The user is using the wrong S3 endpoint (e.g., path-style vs virtual-hosted)

Question 10

Based on the CloudTrail log entry, which security concern should be investigated?

Accepted Answer

Multi-factor authentication (MFA) was not used when assuming the role.. The CloudTrail log entry shows that the `sts:AssumeRole` API call was made without the `aws:MultiFactorAuthPresent` key set to `true`. This indicates that the role was assumed without MFA, which violates the security best practice of requiring MFA for privileged role assumptions. The absence of MFA increases the risk of unauthorized access if the user's credentials are compromised.

Answer

The role used has too many permissions.

Answer

The instance was launched in an unauthorized region.

Answer

The source IP address is from a suspicious location.

Question 11

A developer wants to securely store database credentials for a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager is designed to store and rotate secrets. Option A is wrong because Parameter Store can store secrets but is not as feature-rich for rotation. Option C is wrong because DynamoDB is a database, not a secret store. Option D is wrong because S3 is not secure by default for secrets.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3 with server-side encryption

Answer

Amazon DynamoDB

Question 12

A company has an IAM policy that allows access to an S3 bucket only if the request comes from a specific VPC endpoint. The developer notices that requests from an EC2 instance in that VPC are being denied. What is the most likely cause?

Accepted Answer

The VPC endpoint policy does not allow the required S3 action for the principal. The correct answer is A because the VPC endpoint policy is an additional layer of access control that can explicitly deny actions even if the bucket policy allows them. If the endpoint policy does not grant the required S3 action (e.g., s3:GetObject) for the IAM principal (the EC2 instance's role), requests will be denied regardless of the bucket policy. This is a common misconfiguration where developers focus only on the bucket policy and overlook the endpoint policy.

Answer

The bucket policy does not have a condition checking aws:SourceVpce

Answer

The route table does not have a route to the S3 endpoint

Answer

The security group does not allow outbound HTTPS traffic

Question 13

A company is using AWS CodeCommit and wants to ensure that all commits are signed with GPG keys. Which approach should be used to enforce this?

Accepted Answer

Create an IAM policy that denies codecommit:GitPush unless the commit is signed.. Option C is correct because AWS CodeCommit does not natively support a 'require signed commits' toggle in the repository settings. Instead, you must use an IAM policy with a condition key like `codecommit:referencedRefName` and a custom condition (e.g., using the `git` protocol's signed commit metadata) to deny `codecommit:GitPush` actions when the commit is not signed. This is the only way to enforce GPG signing at the AWS service level.

Answer

Use AWS Organizations service control policies (SCPs) to deny unsigned commits.

Answer

Enable 'Require signed commits' in the CodeCommit repository settings.

Answer

Use an AWS Lambda function as a pre-commit hook in the repository.

Question 14

An application uses IAM roles to grant EC2 instances access to S3. The developer notices that the application works correctly in one account but fails with access denied in another account. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant access to the IAM role. The most likely cause is that the S3 bucket policy in the second account does not explicitly grant the IAM role from the first account (or the second account's own IAM role) the necessary permissions. When an IAM role is used, both the role's trust policy and the resource-based policy (S3 bucket policy) must allow the action; if the bucket policy denies or omits the role's ARN, access will be denied even if the role itself has S3 permissions.

Answer

The IAM role is not attached to the EC2 instance

Answer

The EC2 instance does not have internet access

Answer

The KMS key policy does not allow decryption

Question 15

A developer is creating an IAM policy to allow a Lambda function to write logs to CloudWatch. Which policy should be attached to the Lambda execution role?

Accepted Answer

AWSLambdaBasicExecutionRole. The AWSLambdaBasicExecutionRole managed policy grants permissions for Lambda to write logs to CloudWatch Logs, specifically allowing the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents actions. This is the minimal set of permissions required for a Lambda function to send execution logs to CloudWatch, making it the correct choice for this use case.

Answer

AdministratorAccess

Answer

AmazonDynamoDBFullAccess

Answer

AmazonS3FullAccess

Question 16

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated every 90 days. Which key type should the company use to meet this requirement with minimal operational overhead?

Accepted Answer

Customer managed KMS key with automatic rotation enabled. Customer managed KMS keys support automatic rotation, which can be enabled to rotate the key material every 365 days (or every 90 days if using a custom key store with imported key material). However, the requirement is for 90-day rotation with minimal operational overhead. Automatic rotation for customer managed KMS keys meets this by handling rotation without manual intervention, though note that the default automatic rotation period is 365 days; to achieve exactly 90 days, you would need to use a custom key store and import key material with a 90-day rotation schedule, or manually rotate more frequently. Given the options, B is the best choice because it provides automatic rotation with less overhead than manual rotation.

Answer

Customer managed KMS key with manual rotation

Answer

AWS managed KMS key

Answer

AWS owned KMS key

Question 17

A developer applied the above bucket policy to an S3 bucket. What is the outcome?

Accepted Answer

All requests to the bucket must use HTTPS; otherwise, they are denied.. Option A is correct because the policy denies all S3 actions when the request is not using HTTPS (SecureTransport is false). All other requests are allowed by default. Option B is wrong because it denies all actions, not just write. Option C is wrong because it only denies when not HTTPS. Option D is wrong because it does not allow anonymous access.

Answer

Anonymous users are allowed to read objects.

Answer

Only write requests are denied if not using HTTPS.

Answer

The policy has no effect because it uses Deny.

Question 18

A developer is creating an IAM policy for an EC2 instance to allow it to read from an S3 bucket. Which of the following are required? (Choose TWO.)

Accepted Answer

Create an IAM role with s3:GetObject permissions. Option A is correct because an IAM role must be created with the necessary permissions. Option C is correct because the role must be attached to the EC2 instance. Option B is wrong because S3 bucket policy is optional if using an IAM role; it's needed for cross-account. Option D is wrong because KMS is not required. Option E is wrong because instance profile is not the same as role attachment.

Answer

Use KMS to encrypt the S3 objects

Answer

Configure an S3 bucket policy allowing the role

Answer

Create an instance profile and assign a key pair

Question 19

A developer is building a serverless application using AWS Lambda and API Gateway. The Lambda function needs to access a DynamoDB table that stores sensitive customer data. The developer wants to follow the principle of least privilege. Which IAM role configuration should be used?

Accepted Answer

Create a custom IAM policy with specific DynamoDB actions (e.g., GetItem, PutItem) on the specific table and attach it to the Lambda execution role.. Option D is correct because it adheres to the principle of least privilege by granting only the specific DynamoDB actions (e.g., GetItem, PutItem) required by the Lambda function, scoped to the exact table. The Lambda execution role is an IAM role that the Lambda service assumes, and attaching a custom policy with fine-grained permissions ensures minimal access. This approach avoids over-permissioning and follows AWS security best practices for serverless applications.

Answer

Configure a resource-based policy on the Lambda function to allow DynamoDB access.

Answer

Attach the AmazonDynamoDBFullAccess managed policy to the Lambda execution role.

Answer

Use an S3 bucket policy to grant the Lambda function access to the DynamoDB table.

Question 20

A company wants to allow cross-account access to an S3 bucket in Account A from a role in Account B. The S3 bucket policy in Account A allows the role's ARN. However, access is denied. What is the most likely missing step?

Accepted Answer

The role in Account B must have an IAM policy that allows the S3 actions.. Option B is correct because cross-account S3 access requires both a resource-based policy (the bucket policy in Account A) that grants access to the role ARN, and an identity-based policy (an IAM policy attached to the role in Account B) that explicitly allows the S3 actions. Without the IAM policy in Account B, the role lacks permission to perform the S3 operations, even though the bucket policy permits the access. This is a fundamental principle of AWS cross-account authorization: both the resource side and the principal side must grant the necessary permissions.

Answer

Add a bucket policy that denies access to all principals.

Answer

Disable block public access settings on the bucket.

Answer

Enable ACLs on the S3 bucket.