DVA-C02 Practice Test 41 — 15 Questions

Question 1

A company is building a serverless application using AWS Lambda to process user uploads to Amazon S3. The Lambda function needs to access a DynamoDB table to store metadata. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create an IAM role with a policy that grants DynamoDB access and attach it to the Lambda function.. AWS Lambda uses an IAM role (execution role) to obtain temporary credentials via the AWS Security Token Service (STS). Attaching a policy that grants DynamoDB access to this role follows the principle of least privilege and avoids long-term credentials. This is the standard, secure pattern for granting Lambda functions access to other AWS services.

Answer

Store IAM user access keys in the Lambda function's environment variables.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function's ARN.

Answer

Hardcode the DynamoDB credentials in the Lambda function code.

Question 2

A developer is designing a CI/CD pipeline using AWS CodePipeline. The pipeline deploys a Lambda function. Which THREE practices should be followed to ensure security?

Accepted Answer

Use IAM roles for pipeline actions instead of access keys.. IAM roles provide temporary credentials for AWS services, eliminating the need to manage long-term access keys. CodePipeline can assume an IAM role to perform actions like deploying a Lambda function, which reduces the risk of credential leakage. This follows the principle of least privilege and is a security best practice for automated pipelines.

Answer

Use CloudFront to distribute pipeline artifacts.

Answer

Encrypt artifacts in transit using TLS.

Question 3

Match each AWS security feature to its function.

Accepted Answer

IAM: Controls access to AWS services and resources for users and roles.. The correct matches are IAM with access control, Security Groups with EC2 firewall, KMS with encryption key management, and CloudTrail with API auditing. Common confusions include mistaking IAM for CloudTrail and Security Groups for NACLs.

Answer

IAM: Records API activity in your AWS account.

Answer

Security Groups: Controls network traffic at the subnet level.

Question 4

A company has an IAM policy that allows access to an S3 bucket only if the request comes from a specific VPC endpoint. The developer notices that requests from an EC2 instance in that VPC are being denied. What is the most likely cause?

Accepted Answer

The VPC endpoint policy does not allow the required S3 action for the principal. The VPC endpoint policy is an additional layer of access control that can explicitly deny actions even if the bucket policy allows them. If the endpoint policy does not grant the required S3 action (e.g., s3:GetObject) for the IAM principal (the EC2 instance's role), requests will be denied regardless of the bucket policy. This is a common misconfiguration where developers focus only on the bucket policy and overlook the endpoint policy.

Answer

The bucket policy does not have a condition checking aws:SourceVpce

Answer

The route table does not have a route to the S3 endpoint

Answer

The security group does not allow outbound HTTPS traffic

Question 5

Match each HTTP status code to its meaning.

Accepted Answer

200: OK. Correct matches: 200 OK, 404 Not Found, 500 Internal Server Error. Common confusions include mixing 200 and 201, or 404 and 403.

Answer

200: Created

Answer

404: Forbidden

Question 6

The exhibit shows an IAM policy attached to a user who needs to deploy applications using AWS CodeDeploy. The user reports that they cannot create a deployment for the MyApplication/MyDeploymentGroup. What is the most likely reason?

Accepted Answer

The policy does not include permission on the application resource.. The IAM policy shown in the exhibit likely grants permissions on the deployment group resource (e.g., arn:aws:codedeploy:region:account:deploymentgroup:MyApplication/MyDeploymentGroup) but omits the corresponding application resource (arn:aws:codedeploy:region:account:application:MyApplication). AWS CodeDeploy requires permissions on both the application and the deployment group for operations like CreateDeployment. Without the application-level permission, the request is implicitly denied, causing the failure. Thus, the most likely reason is that the policy does not include permission on the application resource.

Answer

The policy restricts the user to a different deployment group.

Answer

The user does not have permission to call the codedeploy:CreateDeployment action.

Answer

The user does not have permission to call codedeploy:GetDeployment and codedeploy:GetDeploymentGroup.

Question 7

A company uses AWS CodePipeline to deploy a static website to Amazon S3. The pipeline has a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage that uses S3 deployment action. The website is served via Amazon CloudFront. After a successful pipeline run, the updated files are in S3, but CloudFront still serves old content. What is the MOST efficient solution?

Accepted Answer

Add a post-deploy invalidation step in CodePipeline to create a CloudFront invalidation.. It automates the creation of a CloudFront invalidation as part of the CodePipeline post-deploy stage. This ensures that after new files are uploaded to S3, CloudFront's edge caches are purged of the old content, forcing it to fetch the updated files from the origin. This is the most efficient solution as it requires no manual intervention and does not compromise caching performance.

Answer

Manually create a CloudFront invalidation after each deployment.

Answer

Reduce the CloudFront distribution's default TTL to 0.

Answer

Update the S3 bucket policy to allow public read access.

Question 8

Match each AWS service to its primary use case.

Accepted Answer

AWS Lambda: Serverless compute service that runs code in response to events.. Correct matches: Lambda is serverless compute, DynamoDB is NoSQL database, S3 is object storage, Elastic Beanstalk is PaaS. Common confusions include swapping Lambda and DynamoDB definitions.

Answer

AWS Lambda: Fully managed NoSQL database service for key-value and document data.

Answer

Amazon DynamoDB: Serverless compute service that runs code in response to events.

Question 9

Match each AWS storage class to its description.

Accepted Answer

S3 Standard: Designed for frequently accessed data with low latency and high throughput.. The correct matches are S3 Standard with frequently accessed data, S3 Intelligent-Tiering with automatic cost optimization, S3 Glacier Instant Retrieval with archive and fast retrieval, and S3 One Zone-IA with infrequent data in one AZ. Common confusions include mixing up storage class descriptions.

Answer

S3 Standard: Infrequent access data stored in a single Availability Zone.

Answer

S3 Intelligent-Tiering: Archive storage with retrieval times of minutes.

Question 10

A developer needs to send large files (up to 5 GB) from a web application to Amazon S3. The application runs on EC2 instances. Which approach is MOST efficient and reliable?

Accepted Answer

Use S3 multipart upload to upload the file in parts.. S3 multipart upload is the most efficient and reliable approach for uploading large files (up to 5 GB) because it allows the file to be split into smaller parts that can be uploaded in parallel, improving throughput and resilience. If a part fails, only that part needs to be retried, not the entire file, and the upload can be paused and resumed. This is the recommended AWS method for objects larger than 100 MB and is required for objects over 5 GB.

Answer

Save the file to EC2 instance store and then copy to S3.

Answer

Upload the file as a single S3 PutObject operation.

Answer

Use S3 Transfer Acceleration to upload the file.

Question 11

A developer is using Amazon CloudFront to serve static content from an S3 bucket. Users are reporting that they see outdated content. The CloudFront distribution has a default TTL of 24 hours. What is the MOST efficient way to serve updated content immediately?

Accepted Answer

Create a CloudFront invalidation for the updated objects.. Creating a CloudFront invalidation for the updated objects is the most efficient way to immediately serve updated content because it forces CloudFront to fetch the latest version from the origin, bypassing the cached copies. This method is targeted and does not affect other cached objects, making it ideal for urgent updates.

Answer

Disable and re-enable the CloudFront distribution.

Answer

Update the object key in the S3 bucket.

Answer

Change the default TTL to 0.

Question 12

A developer is configuring cross-account access for an S3 bucket. The source account (111111111111) wants to allow the target account (222222222222) to write objects to the bucket. The developer attaches the following bucket policy to the bucket in the source account:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::222222222222:root"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

However, the write operation fails with AccessDenied. What is the most likely cause?

Accepted Answer

The target account has not attached an IAM policy granting the user or role s3:PutObject. Cross-account S3 access requires both a bucket policy that grants the target account principal (or a resource-based policy) AND an IAM policy in the target account that explicitly allows the user or role to perform the s3:PutObject action. Without the target account's IAM policy, the request is denied even if the bucket policy permits it, as the target account's principal lacks the necessary permissions to make the call.

Answer

The bucket has an S3 ACL that denies the target account

Answer

The bucket policy does not allow s3:PutObject for the target account

Answer

The bucket is encrypted with SSE-KMS and the target account lacks KMS permissions

Question 13

A company has an Amazon S3 bucket (Bucket-A) in Account A that contains sensitive data. A developer in Account B needs read-only access to objects in Bucket-A. The developer in Account A added a bucket policy granting s3:GetObject to the IAM user in Account B. However, the IAM user in Account B still receives Access Denied errors. What additional step is required?

Accepted Answer

Create an IAM policy in Account B that allows s3:GetObject for the specific bucket and attach it to the user. The bucket policy in Account A grants access to the IAM user in Account B, but the user's identity in Account B must also have an explicit IAM policy that allows the s3:GetObject action. Without this, the user in Account B lacks the necessary permissions to access the bucket, even though the bucket policy permits it. This is because cross-account access requires both a resource-based policy (bucket policy) in the source account and an identity-based policy (IAM policy) in the target account to authorize the request.

Answer

Add an S3 bucket ACL granting the user in Account B Read access

Answer

Generate a pre-signed URL for each object and share it with the user

Answer

Add a condition in the bucket policy to allow requests only from the user's IP address

Question 14

A company is using an S3 bucket to store sensitive documents. They need to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. The bucket policy must enforce encryption by denying uploads that do not specify the required encryption. Which bucket policy statement should be added?

Accepted Answer

Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'aws:kms'. The bucket policy uses the `s3:x-amz-server-side-encryption` condition key with `StringNotEquals` to deny any upload where the header does not specify `aws:kms`. This ensures that only objects encrypted with AWS KMS (SSE-KMS) are allowed, enforcing server-side encryption at rest. The `Deny` effect combined with this condition blocks requests that either omit the encryption header or specify a different value like `AES256`.

Answer

Condition: StringEquals: 's3:x-amz-server-side-encryption-aws:kms': 'true'

Answer

Condition: Null: 's3:x-amz-server-side-encryption': 'true'

Answer

Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'AES256'

Question 15

An organization wants to deploy a microservices architecture using AWS Lambda functions. They need to manage environment variables for each function across different stages (dev, test, prod). Which approach is the MOST secure and maintainable?

Accepted Answer

Use AWS Systems Manager Parameter Store with separate paths for each stage.. AWS Systems Manager Parameter Store allows you to store configuration data and secrets as parameters with hierarchical paths (e.g., /myapp/dev/db-url, /myapp/prod/db-url). This centralizes management, supports versioning, and enables fine-grained IAM access control per stage. Lambda functions can retrieve these parameters at runtime, ensuring that sensitive values are not exposed in code or function configuration. This approach is both secure (encryption via KMS, audit via CloudTrail) and maintainable (update once, applies everywhere).

Answer

Use AWS CloudFormation parameters to pass values at deployment.

Answer

Hardcode the environment variables in each Lambda function code.

Answer

Store environment variables in the Lambda function configuration.