DVA-C02 Practice Test 35 — 15 Questions

Question 1

A developer is using AWS KMS to encrypt data. Which TWO are valid operations that can be performed using KMS?

Accepted Answer

Generate data keys for envelope encryption.. KMS can generate data keys for envelope encryption using the GenerateDataKey API, which returns a plaintext data key and an encrypted copy. Option D is correct because KMS can directly encrypt data (up to 1 KB) using a customer master key via the Encrypt API. Option A is incorrect because KMS does not store keys on an HSM in your data center; AWS manages the HSMs within its infrastructure. Option C is incorrect because KMS does not provide a keyed hash function; hashing is not a KMS operation. Option E is incorrect because KMS does not generate SSL/TLS certificates; that is handled by AWS Certificate Manager (ACM).

Answer

Store customer-managed keys on an HSM in your data center.

Answer

Hash data using a keyed hash function.

Answer

Generate SSL/TLS certificates for a domain.

Question 2

Which TWO of the following are best practices for securing AWS account root user?

Accepted Answer

Delete the root user access keys.. Deleting root user access keys prevents unauthorized use via programmatic access. Option E is correct: Enabling MFA adds an extra layer of security. Option B is incorrect because the root user should not be used for daily tasks; use IAM users instead. Option C is incorrect because AWS does not automatically lock the root user after failed attempts. Option D is incorrect because sharing the root user password is a security risk.

Answer

Use the root user for daily administrative tasks.

Answer

Set a password policy that locks the root user after 10 failed attempts.

Answer

Share the root user password with senior developers for emergencies.

Question 3

A developer needs to securely store database credentials and retrieve them programmatically from a Lambda function. Which AWS services can be used for this purpose? (Choose TWO.)

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). Options A and B are correct. AWS Systems Manager Parameter Store (SecureString) and AWS Secrets Manager are both designed to securely store database credentials and other secrets, and allow programmatic retrieval from Lambda functions. AWS CloudFormation (option C) is for infrastructure as code, not for storing secrets. AWS IAM (option D) is for managing permissions, not for storing secrets. Amazon S3 (option E) is for object storage and is not a secure secrets management service.

Answer

AWS CloudFormation

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon S3

Question 4

A developer is designing a microservices architecture using Amazon ECS with Fargate. The services need to communicate with each other. Which TWO options can the developer use for service discovery?

Accepted Answer

AWS Cloud Map. AWS Cloud Map provides DNS-based service discovery for microservices. Option C is correct because Amazon ECS Service Connect is a native ECS feature that simplifies service discovery and connectivity within ECS tasks. Option B is incorrect because AWS Global Accelerator improves global traffic routing, not service discovery. Option D is incorrect because Amazon Route 53 private hosted zones are used for custom domain names within a VPC, not for dynamic service discovery in ECS. Option E is incorrect because an internal Application Load Balancer is used for load balancing, not service discovery.

Answer

AWS Global Accelerator

Answer

Amazon Route 53 private hosted zones

Answer

Application Load Balancer internal

Question 5

A company is using Amazon S3 to store log files. The logs are rarely accessed after 30 days but must be retained for 7 years for compliance. Which THREE actions should the company take to optimize storage costs?

Accepted Answer

Use S3 Lifecycle policy to transition objects to S3 Glacier after 1 year.. Transitioning objects to S3 Glacier after 1 year reduces storage costs for long-term retention while maintaining compliance. Option D is correct because lifecycle policies can expire objects after 7 years, meeting the retention requirement. Option E is correct because transitioning to S3 Standard-IA after 30 days optimizes costs for infrequently accessed logs. Option A is wrong because deleting objects after 30 days violates the 7-year retention requirement. Option B is wrong because S3 One Zone-IA lacks the durability needed for compliance data and is not cost-effective if logs are accessed frequently in the first 30 days.

Answer

Use S3 Lifecycle policy to delete objects after 30 days.

Answer

Store objects in S3 One Zone-IA from the start.

Question 6

A developer is using AWS CodeBuild to run unit tests as part of a CI/CD pipeline. The developer wants to store the test results for later analysis. Which TWO AWS services can the developer use to store and view the test reports?

Accepted Answer

AWS CodeBuild test reports. AWS CodeBuild test reports is a built-in feature that allows you to view test results directly in the CodeBuild console, enabling analysis of test reports. Option D: Amazon S3 can be used to store raw test result files (e.g., XML reports) for later retrieval and analysis. Option B: AWS X-Ray is for distributed tracing, not for storing test reports. Option C: Amazon Athena is a query service for data in S3, not a storage or viewing service for test reports. Option E: Amazon CloudWatch Logs is for log data, not structured test reports.

Answer

AWS X-Ray

Answer

Amazon Athena

Answer

Amazon CloudWatch Logs

Question 7

A developer is using AWS CodePipeline to automate the deployment of a microservices application. The pipeline consists of a source stage (GitHub), a build stage (AWS CodeBuild), and a deploy stage (Amazon ECS). The developer wants to ensure that only approved changes are deployed to production. Which THREE actions should the developer take? (Choose THREE.)

Accepted Answer

Add a manual approval step before the deploy stage.. To ensure only approved changes are deployed to production, the developer should implement a manual approval step (option C) to gate deployments, use separate pipelines for different environments (option D) to isolate changes, and include integration tests in the build stage (option E) to catch errors early. Automatic deployment to production (option A) bypasses approval, and deploying all feature branches directly (option B) introduces unverified code, making both risky.

Answer

Configure the pipeline to automatically deploy every commit to production.

Answer

Deploy all feature branches directly to production.

Question 8

A developer wants to encrypt data in an S3 bucket using server-side encryption with AWS KMS (SSE-KMS). Which TWO steps are required?

Accepted Answer

Set the default encryption on the bucket to SSE-KMS.. The bucket must be configured for SSE-KMS, and the IAM role must have kms:GenerateDataKey and kms:Decrypt permissions.

Answer

Enable MFA Delete on the bucket.

Answer

Create a bucket policy that denies unencrypted requests.

Answer

Enable versioning on the bucket.

Question 9

A developer wants to ensure that an S3 bucket is not publicly accessible. Which TWO measures should the developer implement?

Accepted Answer

Review the bucket policy to ensure it does not allow public access.. To prevent public access to an S3 bucket, two effective measures are: (1) reviewing the bucket policy (D) to ensure no statements grant public access, and (2) enabling S3 Block Public Access settings (E) which override any policies or ACLs that allow public access. Option A (server access logging) is for auditing access, not controlling it. Option B (versioning) is for preserving object versions. Option C (default encryption) protects data at rest, not access control.

Answer

Enable S3 server access logging.

Answer

Enable versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 10

A developer notices that an IAM user has permissions to terminate EC2 instances, but the user should only be allowed to stop instances. The developer needs to update the policy to prevent termination while allowing stop. Which IAM policy statement should be added?

Accepted Answer

{"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"}. A Deny statement explicitly blocks the specified action, overriding any Allow policies. Since the IAM user currently has permission to terminate EC2 instances (via an Allow policy), adding a Deny for ec2:TerminateInstances will prevent termination while still allowing the user to stop instances (if allowed by another policy). Option A provides this Deny. Option B is an Allow that would not block termination. Option C allows both stop and terminate. Option D is unrelated.

Answer

{"Effect":"Allow","Action":"ec2:TerminateInstances","Resource":"*"}

Answer

{"Effect":"Allow","Action":["ec2:StopInstances","ec2:TerminateInstances"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"ec2:RebootInstances","Resource":"*"}

Question 11

A developer attaches the above bucket policy to an S3 bucket. An anonymous user tries to access https://my-bucket.s3.amazonaws.com/secret/key.txt. What is the result?

Accepted Answer

Access is denied because the explicit Deny overrides the Allow.. The explicit Deny statement for the 'secret/' prefix overrides the Allow statement that grants access to all objects. Even though the Allow grants access to all objects, the Deny specifically denies access to objects under 'secret/', and explicit Deny always takes precedence. Option B is incorrect because the Deny overrides the Allow for the specified prefix. Option C is incorrect because Deny statements apply to all users, including anonymous users. Option D is incorrect because having two statements that conflict does not make the policy invalid; the explicit Deny simply takes precedence.

Answer

Access is allowed because the Allow statement covers all objects.

Answer

Access is allowed because anonymous requests are not affected by Deny statements.

Answer

Access is denied because the policy is invalid (two statements conflict).

Question 12

Refer to the exhibit. A developer created this CloudFormation template. After deployment, the stack creation fails with 'Bucket name already exists'. What should the developer do to fix the issue?

Accepted Answer

Change the BucketName to include a random suffix.. The error 'Bucket name already exists' indicates that the S3 bucket name is not unique. Adding a random suffix to the BucketName (e.g., using AWS::StackName or a random string) ensures uniqueness. Option B is incorrect because removing the queue does not address the bucket naming conflict. Option C is incorrect because disabling versioning does not affect the bucket name. Option D is incorrect because disabling SSE is unrelated to the bucket name conflict.

Answer

Remove the MyQueue resource.

Answer

Remove the VersioningConfiguration from the bucket.

Answer

Set SqsManagedSseEnabled to false.

Question 13

A developer is using AWS CodeBuild to compile and package a Java application. The build process takes longer than expected. The developer wants to speed up the build by reusing dependencies that have not changed between builds. Which feature should the developer enable?

Accepted Answer

Enable caching for the CodeBuild project by specifying an S3 bucket for cache storage. Enable caching for the CodeBuild project by specifying an S3 bucket for cache storage. CodeBuild caching allows reusing previously downloaded dependencies, reducing build time. Option A is incorrect because running builds concurrently does not reuse dependencies across builds; it runs separate builds simultaneously. Option B is incorrect because enabling build artifacts does not affect dependency caching; artifacts are outputs. Option D is incorrect because storing artifacts in S3 does not provide caching for dependencies; it only stores the build output.

Answer

Configure the build project to run builds concurrently

Answer

Enable build artifacts in the CodeBuild project

Answer

Store the build's output artifacts in an S3 bucket

Question 14

A company wants to give a third-party auditor read-only access to their AWS account for compliance purposes. What is the most appropriate way to grant this access?

Accepted Answer

Create an IAM role with the SecurityAudit managed policy and allow the auditor to assume it.. An IAM role with the SecurityAudit managed policy provides read-only access to security-related services, allowing the third-party auditor to assume the role and obtain temporary credentials. This follows the principle of least privilege and avoids sharing long-term access keys or root credentials. Option A is wrong because AdministratorAccess grants full administrative privileges, not read-only. Option C is wrong because a policy allowing all actions also provides full access, not read-only. Option D is wrong because sharing root account credentials is a severe security risk and violates AWS best practices.

Answer

Attach the AdministratorAccess managed policy to an IAM user.

Answer

Create an IAM user with a custom policy that allows all actions.

Answer

Share the root account credentials with the auditor.

Question 15

Match each AWS security feature to its function.

Accepted Answer

IAM: Controls access to AWS services and resources for users and roles.. The correct matches are IAM with access control, Security Groups with EC2 firewall, KMS with encryption key management, and CloudTrail with API auditing. Common confusions include mistaking IAM for CloudTrail and Security Groups for NACLs.

Answer

IAM: Records API activity in your AWS account.

Answer

Security Groups: Controls network traffic at the subnet level.