DVA-C02 Practice Test 50 — 15 Questions

Question 1

A company is designing a multi-account strategy using AWS Organizations. They want to enable cross-account access for developers using IAM roles. Each developer has an IAM user in the 'developers' account. The 'production' account has an IAM role 'AdminRole' that can be assumed by the 'developers' account. Which trust policy should be attached to 'AdminRole'?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]} where 123456789012 is the developers account ID.. The trust policy on the 'AdminRole' in the production account must allow the entire 'developers' account (using its root ARN) to assume the role. When an IAM user in the developers account calls sts:AssumeRole, AWS evaluates the trust policy; specifying the root ARN of the developers account (arn:aws:iam::123456789012:root) delegates trust to the entire account, and the individual user's permissions are then controlled by an IAM policy attached to the user or a group that grants sts:AssumeRole for this role.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/*"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/AdminRole"},"Action":"sts:AssumeRole"}]}

Question 2

A company uses AWS Lambda to process sensitive data. The Lambda function needs to access an RDS database with a password stored in AWS Secrets Manager. The function currently retrieves the secret using the AWS SDK. What is the best practice to secure this setup?

Accepted Answer

Configure the Lambda function to use IAM database authentication for RDS.. IAM database authentication eliminates the need to store or retrieve a password entirely. The Lambda function assumes an IAM role that generates a temporary authentication token (valid for 15 minutes) using the AWS SDK, which is then used to connect to RDS via TLS. This approach follows the principle of least privilege and removes the risk of static credentials being exposed or misused.

Answer

Store the password as a Lambda environment variable encrypted with KMS.

Answer

Use the AWS CLI within the Lambda function to fetch the secret each time.

Answer

Rotate the secret daily using Secrets Manager and cache it in Lambda.

Question 3

A developer is deploying an application using AWS Elastic Beanstalk. The application needs to connect to an Amazon RDS database. What is the best practice for storing database credentials?

Accepted Answer

Store credentials in AWS Secrets Manager and retrieve them at runtime.. AWS Secrets Manager provides a secure, auditable service for rotating and managing database credentials. By retrieving secrets at runtime via the AWS SDK, the application avoids embedding sensitive data in code or configuration, which is a key security best practice for Elastic Beanstalk deployments.

Answer

Hardcode the credentials in the application code.

Answer

Store credentials in Elastic Beanstalk environment properties.

Answer

Store credentials in an Amazon S3 bucket with public read access.

Question 4

A company uses AWS Lambda functions behind an API Gateway REST API. The Lambda functions are written in Python and use the boto3 SDK to interact with DynamoDB. After a recent deployment, some users report sporadic 502 Bad Gateway errors when calling the API. The Lambda function logs show occasional 'AccessDeniedException' errors. What is the most likely cause and solution?

Accepted Answer

The Lambda execution role lacks permissions to access DynamoDB. Update the role to include the necessary DynamoDB actions.. The 'AccessDeniedException' error in the Lambda logs indicates that the Lambda function's execution role does not have the necessary IAM permissions to perform the requested DynamoDB operation. This is a common misconfiguration after deployments where the role or its attached policies are not updated to include the required DynamoDB actions (e.g., dynamodb:GetItem, dynamodb:PutItem). The 502 Bad Gateway from API Gateway is a direct consequence of the Lambda function failing internally due to this permission error.

Answer

The Lambda function is timing out. Increase the timeout value in the Lambda configuration.

Answer

The DynamoDB table is throttling requests. Enable auto-scaling for the table.

Answer

The API Gateway request is too large. Set the payload size limit higher in API Gateway settings.

Question 5

A developer is deploying a new version of an AWS Lambda function using the AWS CLI. The developer wants to create a new version and update the alias to point to the new version. Which sequence of CLI commands should the developer use?

Accepted Answer

Update function code, publish version, update alias. The correct sequence is to first update the function code, then publish a new version, and finally update the alias to point to that new version. The `update-function-code` command uploads the new code to the $LATEST version, `publish-version` creates an immutable numbered version from $LATEST, and `update-alias` updates the alias to reference that specific version. This ensures the alias always points to a stable, published version rather than the mutable $LATEST.

Answer

Update alias, update function code, publish version

Answer

Create alias, update function code, publish version

Answer

Publish version, update function code, update alias

Question 6

A developer is debugging an issue where an IAM user cannot list objects in an S3 bucket. The user has the following IAM policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::example-bucket" } ] }. What is missing?

Accepted Answer

The policy needs to also allow s3:GetObject on the objects.. The IAM policy only grants the s3:ListBucket permission, which allows listing the objects in the bucket but not reading their contents. To actually list objects, the s3:ListBucket action is sufficient; however, the question implies the user cannot list objects at all. The missing permission is s3:GetObject, which is required to retrieve object metadata and data when using certain S3 operations like GetObject or HeadObject. Without s3:GetObject, the user may fail to list objects if the bucket policy or ACLs require read access for the listing operation to succeed.

Answer

The Resource ARN is incorrect.

Answer

The bucket has a bucket policy that denies access.

Answer

The user needs to enable S3 ACLs.

Question 7

A developer is building a serverless application using AWS Lambda. The function needs to access a private S3 bucket in the same AWS account. What is the BEST way to grant the Lambda function access to the bucket?

Accepted Answer

Create an IAM execution role with an S3 access policy and attach it to the Lambda function.. The correct answer. The best practice for granting an AWS Lambda function access to an S3 bucket in the same account is to create an IAM execution role with a policy that allows the necessary S3 actions, and then attach that role to the Lambda function. This provides temporary credentials via STS, follows the principle of least privilege, and avoids hardcoding credentials.

Option B is incorrect because storing AWS credentials in environment variables is insecure and can lead to accidental exposure. AWS recommends using IAM roles for temporary credentials.

Option C is incorrect because Lambda functions do not support attaching IAM policies directly. Policies must be attached to an IAM role, and that role is assigned to the function.

Option D is incorrect because while a bucket policy could grant access based on the function's ARN, it is not the best approach for same-account access. Using an execution role is more scalable, easier to manage, and follows the principle of least privilege.

Answer

Store AWS credentials in environment variables and use them in the function code.

Answer

Attach an inline IAM policy directly to the Lambda function.

Answer

Add a bucket policy to the S3 bucket allowing the Lambda function's ARN.

Question 8

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted using SSE-KMS with a specific KMS key from the central security account. They also want to prevent any unencrypted bucket creation. A developer in the development account creates a new S3 bucket and enables default encryption using SSE-S3. The bucket creation succeeds, but the security team wants to prevent this. The developer argues that the bucket still encrypts data at rest. Compliance requires SSE-KMS only. What should the security team do to enforce this policy across all accounts?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutObject and s3:PutBucketEncryption unless the encryption is SSE-KMS with the specific KMS key.. A service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny S3 bucket creation and encryption configuration unless SSE-KMS with the specific KMS key is used. SCPs affect all accounts in the organization, preventing developers from bypassing the policy by creating buckets with SSE-S3, as the SCP condition key `s3:x-amz-server-side-encryption` and `s3:x-amz-server-side-encryption-aws-kms-key-id` enforce the required encryption at the API level before the bucket is created.

Answer

Create an IAM policy in the central security account that denies s3:PutBucketEncryption if the encryption is not SSE-KMS.

Answer

Use AWS Config to detect non-compliant buckets and automatically apply default encryption with SSE-KMS.

Answer

Enable CloudTrail to log all S3 API calls and manually review for non-compliant buckets.

Question 9

A developer is designing a web application that will run on EC2 instances behind an Application Load Balancer. The application needs to authenticate users. Which service should the developer use to manage user identities and provide single sign-on?

Accepted Answer

Amazon Cognito. Amazon Cognito is the correct choice because it is a fully managed identity service designed for web and mobile applications. It provides user sign-up, sign-in, and access control, and supports single sign-on (SSO) through federation with social identity providers (e.g., Google, Facebook) and enterprise identity providers via SAML 2.0 or OIDC. This makes it ideal for authenticating users in an application running behind an Application Load Balancer.

Answer

AWS IAM

Answer

AWS Directory Service

Answer

AWS Security Token Service (STS)

Question 10

A developer is using the AWS Serverless Application Model (SAM) to define a serverless application with an API Gateway endpoint. The developer wants to enable API caching only in the development stage to speed up testing, but disable it in the production stage to ensure data freshness. What is the most efficient way to achieve this with SAM?

Accepted Answer

Use AWS SAM parameters with a condition to set CacheClusterEnabled based on the stage parameter.. AWS SAM parameters allow you to define a stage parameter (e.g., 'dev' or 'prod') and use a condition to conditionally set the `CacheClusterEnabled` property on the `AWS::Serverless::Api` resource. This is the most efficient approach because it uses a single template and SAM's built-in intrinsic functions (like `Fn::Equals`) to toggle caching based on the deployment stage, avoiding separate templates or post-deployment custom resources.

Answer

Deploy two separate SAM templates, one for each stage.

Answer

Use a custom resource to toggle caching after deployment.

Answer

Enable caching globally and configure a usage plan with a quota for production.

Question 11

A developer is using AWS CodeDeploy to deploy an application to a fleet of EC2 instances in an Auto Scaling group. The application must remain available during the deployment. The developer wants to update one instance at a time, ensuring that only one instance is taken offline at any moment. Which deployment configuration should the developer choose?

Accepted Answer

CodeDeployDefault.OneAtATime. CodeDeployDefault.OneAtATime is the correct deployment configuration because it deploys the application to only one instance at a time, ensuring that the remaining instances continue to serve traffic. This matches the requirement to take only one instance offline at any moment, preserving high availability throughout the deployment.

Answer

CodeDeployDefault.HalfAtATime

Answer

CodeDeployDefault.AllAtOnce

Answer

CodeDeployDefault.LambdaCanary10Percent5Minutes

Question 12

A developer is creating a web application that uses Amazon Cognito for user authentication. The application needs to verify the identity of users before allowing access to the API. Which Cognito feature should the developer use?

Accepted Answer

User Pools. Amazon Cognito User Pools provide a fully managed identity and access management service specifically designed for user authentication and authorization in web and mobile applications. They handle user sign-up, sign-in, and identity verification through features like multi-factor authentication (MFA) and JSON Web Token (JWT) issuance, making them the correct choice for verifying user identity before granting API access.

Answer

Identity Pools

Answer

Cognito Sync

Answer

Cognito Events

Question 13

A developer is creating an AWS Lambda function to process events from an Amazon SQS queue. The function must process each message exactly once and in order. Which SQS queue type should the developer use?

Accepted Answer

FIFO queue.. FIFO queue. FIFO (First-In-First-Out) queues guarantee exactly-once processing and preserve the order of messages, which is required by the use case. Standard queues offer at-least-once delivery and do not guarantee order, making them unsuitable for this requirement.

Answer

Standard queue.

Answer

Dead-letter queue.

Answer

Delay queue.

Question 14

A developer wants to securely store database credentials used by a Lambda function. The credentials should be automatically rotated every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials and other secrets. It supports native rotation with built-in integration for Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, MariaDB) and Amazon DocumentDB, allowing you to configure automatic rotation every 90 days without custom code. The service encrypts secrets at rest using AWS KMS and enforces fine-grained access control via IAM policies.

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Systems Manager Parameter Store

Question 15

A developer needs different configuration values for dev, test, and prod in the same SAM template. Which feature is suitable?

Accepted Answer

Parameters and environment-specific parameter overrides. AWS SAM supports Parameters and environment-specific parameter overrides, allowing you to define a single template and supply different configuration values (e.g., database URLs, API keys) for dev, test, and prod environments at deployment time. This is achieved by passing a JSON or YAML file with the `--parameter-overrides` flag in the `sam deploy` command, or by using the `parameters` section in a `samconfig.toml` file. This approach avoids duplicating templates and keeps infrastructure-as-code DRY and maintainable.

Answer

Hardcoded ARNs in every function

Answer

One AWS root account per environment

Answer

Disabling stack updates