DVA-C02 Practice Test 46 — 15 Questions

Question 1

A developer attaches the above S3 bucket policy to my-bucket. A user tries to upload an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The upload is denied. Option A is correct because the policy denies s3:PutObject if SecureTransport is false. Since the request uses HTTP, SecureTransport is false, so the Deny applies and the upload fails. Option B is wrong because the condition is evaluated. Option C is wrong because the Deny overrides any Allow. Option D is wrong because the policy explicitly denies.

Answer

The upload succeeds because the Deny effect only applies if the condition is true

Answer

The upload succeeds if the user also has an Allow in another policy

Answer

The upload succeeds because there is no Allow statement

Question 2

A company wants to give a third-party auditor read-only access to their AWS account for compliance purposes. What is the most appropriate way to grant this access?

Accepted Answer

Create an IAM role with the SecurityAudit managed policy and allow the auditor to assume it.. Option D is correct because an IAM role with the SecurityAudit policy provides read-only access to security services and is the least privilege. Option A is wrong because creating an IAM user is less secure than a role. Option B is wrong because root account access should never be shared. Option C is wrong because the AdministratorAccess policy is not read-only.

Answer

Attach the AdministratorAccess managed policy to an IAM user.

Answer

Create an IAM user with a custom policy that allows all actions.

Answer

Share the root account credentials with the auditor.

Question 3

Refer to the exhibit. A developer is trying to query a DynamoDB table from a Lambda function that uses an execution role named MyRole. The Lambda function is failing with the error shown. Which step should the developer take to resolve this?

Accepted Answer

Attach a policy to the Lambda execution role that allows dynamodb:Query on the table.. Option B is correct because the error indicates the role lacks dynamodb:Query permission. Option A is wrong because the error is about missing permission, not resource policy. Option C is wrong because the error is not about encryption. Option D is wrong because the error is not about KMS.

Answer

Enable DynamoDB encryption at rest.

Answer

Add a resource-based policy to the DynamoDB table allowing the Lambda role.

Answer

Grant the Lambda role kms:Decrypt permission on the KMS key.

Question 4

A company has a multi-account architecture using AWS Organizations. The security team wants to centrally manage IAM policies that apply to all accounts. Which AWS feature should the developer use?

Accepted Answer

Service control policies (SCPs) in AWS Organizations.. S CPs are used in AWS Organizations to centrally control the maximum permissions for accounts. They affect all IAM users and roles in the member accounts. Option A is wrong because IAM roles are per-account. Option B is wrong because IAM policies are per-account. Option D is wrong because AWS Config is for compliance, not permission management.

Answer

IAM cross-account roles.

Answer

AWS Config conformance packs.

Answer

IAM policies attached to the root user.

Question 5

A developer attached the above IAM policy to an IAM user. The user is trying to get an object from the bucket 'example-bucket' from an on-premises machine with public IP 203.0.113.5. What will happen?

Accepted Answer

Access is denied because the condition is not met. Option C is correct because the policy allows s3:GetObject only from IP 10.0.0.1/32. Since the request comes from 203.0.113.5, the condition fails, and access is denied. Option A is wrong because the condition is not ignored. Option B is wrong because the condition explicitly restricts to a specific IP. Option D is wrong because the condition restricts to a specific IP, not a VPN.

Answer

Access is allowed because the user has an Allow effect

Answer

Access is allowed if the user uses a VPN with the specified IP

Answer

Access is allowed because the user's IP is not denied

Question 6

A developer is building a serverless application with AWS Lambda that needs to read from an Amazon DynamoDB table. The Lambda function is in a VPC. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Attach an IAM role to the Lambda function that allows the necessary DynamoDB actions.. The best practice is to attach an IAM role to the Lambda function with a policy that grants only the required DynamoDB actions (e.g., GetItem, Query). Lambda does not require a VPC endpoint for DynamoDB if it has internet access via a NAT gateway, but the IAM role is essential. Option A is wrong because VPC endpoints are for private connectivity, not authorization. Option C is wrong because hard-coding keys is insecure. Option D is wrong because Lambda does not use instance profiles.

Answer

Create a VPC endpoint for DynamoDB and associate a security group.

Answer

Store DynamoDB credentials in AWS Secrets Manager and retrieve them in the Lambda code.

Answer

Use an EC2 instance profile attached to the Lambda function's execution environment.

Question 7

A developer is deploying an application with AWS CodeDeploy. The application needs to access a database password. Which service should be used to securely store and retrieve the password?

Accepted Answer

AWS Secrets Manager. Option C is correct because AWS Secrets Manager is designed to store secrets and automatically rotate them. Option A is wrong because Parameter Store can store secrets but lacks automatic rotation. Option B is wrong because DynamoDB is a database, not a secrets store. Option D is wrong because CloudFormation is for infrastructure as code, not secret management.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudFormation template parameters

Answer

Amazon DynamoDB with encryption at rest

Question 8

A company has an IAM policy that allows s3:GetObject for all users in the account. However, a specific user is receiving access denied errors. Which TWO possible causes should the developer investigate?

Accepted Answer

An SCP at the organization level denies s3:GetObject.. A bucket policy with an explicit Deny overrides the IAM policy. Also, a service control policy (SCP) at the organizational level can deny access.

Answer

The user is using an incorrect region endpoint.

Answer

The user's IAM role has an attached policy that denies s3:GetObject.

Answer

The S3 bucket is in a different AWS account.

Question 9

A developer is using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function needs to write logs to CloudWatch Logs. Which of the following is required to allow this?

Accepted Answer

Attach an IAM policy to the Lambda execution role with CloudWatch Logs permissions. The Lambda function's execution role must include a policy that allows logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. This is the standard approach for Lambda logging.

Answer

Add a resource-based policy to the Lambda function

Answer

Configure the S3 bucket to trigger Lambda, and Lambda automatically logs to CloudWatch

Answer

Create an IAM role for CloudWatch Logs and assign it to the Lambda function

Question 10

A company is using AWS Secrets Manager to rotate database credentials automatically. The rotation Lambda function fails with a timeout error after 30 seconds. The developer checked the Lambda logs and saw that the function is making network calls to the database but never receives a response. What is the MOST likely cause?

Accepted Answer

The Lambda function is not attached to a VPC with a NAT gateway or VPC endpoints for Secrets Manager.. Option A is correct because Lambda functions in a VPC require a NAT gateway or VPC interface endpoints to access the internet or AWS services outside the VPC. The database is likely in a private subnet without internet access, and the Secrets Manager endpoint might be unreachable, causing the timeout. Options B, C, and D are incorrect because increasing timeout or memory would not solve network connectivity issues, and disabling rotation would not address the root cause.

Answer

The Lambda function memory is insufficient; increase memory to 1024 MB.

Answer

The Lambda function timeout is set too low; increase it to 5 minutes.

Answer

The database credentials are incorrect; the rotation function cannot authenticate.

Question 11

A company is deploying a web application on EC2 instances behind an ALB. The application needs to authenticate users using a corporate identity provider that supports SAML 2.0. Which of the following are required to configure this? (Choose THREE.)

Accepted Answer

Obtain the IdP's metadata document to configure the trust.. Options A, B, and D are correct. The ALB can authenticate users via SAML by creating a rule that uses an IdP. The IdP must be registered in IAM as a SAML provider. The ALB must be configured with a listener rule that uses that provider. Option C is incorrect because Cognito is not required. Option E is incorrect because the IdP is not registered in Route 53.

Answer

Configure Amazon Cognito as an intermediary.

Answer

Register the corporate IdP in Amazon Route 53.

Question 12

A company is using AWS CodePipeline to deploy a web application. The pipeline must securely store and use database credentials. Which AWS service should the developer use to store the credentials and retrieve them during deployment?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is designed to store secrets like database passwords and supports automatic rotation. It integrates with CodePipeline via Lambda functions. Option A is wrong because SSM Parameter Store can store secrets but lacks native rotation for RDS. Option C is wrong because DynamoDB is not a secrets store. Option D is wrong because IAM roles are for AWS service access, not for storing database credentials.

Answer

IAM role attached to the CodePipeline service role.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Amazon DynamoDB with server-side encryption.

Question 13

The exhibit shows an IAM policy attached to a Lambda function's execution role. When the Lambda function tries to decrypt data using the KMS key, it receives an access denied error. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the Lambda execution role permission to use the key.. The policy grants kms:Decrypt but not kms:DescribeKey. However, the error is likely due to the Lambda function not having permission to call kms:Decrypt because the key's key policy might not grant the Lambda role. The key policy must explicitly allow the Lambda role to use the key. Option A is wrong because kms:Decrypt is included. Option B is wrong because it's not about kms:DescribeKey. Option C is wrong because the action list is correct. Option D is correct: the key policy must grant access to the Lambda role.

Answer

The policy uses an incorrect action name for decryption.

Answer

The policy does not include kms:DescribeKey permission.

Answer

The policy does not include kms:Decrypt permission.

Question 14

A developer needs to grant an IAM user access to an S3 bucket owned by another AWS account. Which method should be used?

Accepted Answer

Attach a bucket policy to the bucket that allows the user's IAM user ARN.. Cross-account access requires a bucket policy in the account owning the bucket, granting access to the IAM user ARN from the other account.

Answer

Create an IAM role in the bucket owner account and allow the user to assume it.

Answer

Create a new IAM user in the bucket owner account for the developer.

Answer

Add the user to a bucket ACL granting access.

Question 15

A developer is deploying an application on EC2 that must access an S3 bucket. The developer wants to avoid hard-coding credentials. What is the MOST secure way to grant access?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. Creating an IAM role with an instance profile and assigning it to the EC2 instance is the most secure method. It provides temporary credentials automatically via the EC2 metadata service. Option A is wrong because storing keys in a config file is not secure. Option B is wrong because S3 bucket policies are resource-based and should be used in combination with IAM roles, but the primary method is the instance profile. Option D is wrong because environment variables can be read by processes and are less secure than instance profiles.

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP address.

Answer

Set the AWS credentials as environment variables in the user data script.

Answer

Store the AWS access key ID and secret access key in a configuration file on the instance.

DVA-C02 Practice Test 46 — 15 Questions

Exhibit

DVA-C02 Practice Test 46 — 15 Questions

Exhibit