DVA-C02 Mock Exam 73 — 25 Questions

Question 1

A developer is designing an application that will process credit card payments and store them temporarily in an Amazon DynamoDB table. The developer must ensure that the payment data is encrypted at rest and that the encryption key is managed by the company's security team using AWS KMS. Which type of encryption should the developer enable on the DynamoDB table?

Accepted Answer

Server-side encryption with a customer-managed KMS key. Option A is correct because the requirement specifies that the encryption key must be managed by the company's security team. Server-side encryption (SSE) with a customer-managed KMS key allows the company to create, rotate, and control access to the KMS key used to encrypt the DynamoDB table at rest. This gives the security team full control over the encryption key lifecycle, meeting the stated requirement.

Answer

Server-side encryption with an AWS managed KMS key

Answer

Client-side encryption

Answer

Static key encryption

Question 2

A developer launches an Amazon EC2 instance that needs to read and write data to an Amazon DynamoDB table. The developer must follow the principle of least privilege and ensure that no long-term credentials are stored on the instance. Which approach should the developer use?

Accepted Answer

Create an IAM role with the necessary DynamoDB permissions, and attach the role to the EC2 instance profile. The SDK will automatically retrieve temporary credentials from the instance metadata.. Option C is correct because it uses an IAM role attached to the EC2 instance profile, which allows the AWS SDK to automatically retrieve temporary credentials from the instance metadata service (IMDS). This follows the principle of least privilege by granting only the necessary DynamoDB permissions and eliminates the need to store any long-term credentials on the instance, as the credentials are rotated automatically by AWS STS.

Answer

Create an IAM user with programmatic access, store the access key and secret key in a configuration file on the EC2 instance.

Answer

Store the DynamoDB credentials in AWS Systems Manager Parameter Store as a SecureString, and retrieve them from the EC2 instance at runtime.

Answer

Use a Lambda function to generate temporary credentials for the EC2 instance and pass them via user data at launch.

Question 3

A developer needs to securely distribute temporary AWS credentials to authenticated mobile users. Which two components are commonly involved?

Accepted Answer

Amazon Cognito identity pools. Amazon Cognito identity pools allow you to exchange identity tokens (from a user pool or external IdP) for temporary AWS credentials via the AWS Security Token Service (STS). These credentials are scoped to an IAM role with fine-grained permissions, enabling secure, least-privilege access to AWS resources from mobile apps without embedding long-term keys.

Answer

AWS root access keys

Answer

An unrestricted S3 bucket policy

Question 4

A developer needs to grant an IAM role in the same AWS account read-only access to objects in a specific S3 bucket. The bucket is configured with a bucket policy that has an explicit Deny statement denying all principals except the root user. Which approach should the developer use to grant the required access?

Accepted Answer

Modify the bucket policy to allow the IAM role explicitly, or remove the Deny statement. The bucket policy contains an explicit Deny that overrides any allow permissions, including those granted by an IAM policy attached to the role. To grant the IAM role read-only access, the developer must either remove the Deny statement or add an explicit Allow for the role in the bucket policy, because an explicit Deny in a resource-based policy cannot be overridden by an identity-based policy.

Answer

Attach an IAM policy to the role that allows s3:GetObject on the bucket

Answer

Use an S3 access point instead of the bucket directly

Answer

Make the bucket public to allow all access

Question 5

A developer runs an application on Amazon EC2 that needs to securely store database credentials (username and password). The security team requires that the credentials be automatically rotated every 30 days. Which AWS service should the developer use to store and automatically rotate the credentials?

Accepted Answer

AWS Secrets Manager with automatic rotation enabled.. AWS Secrets Manager is designed specifically for managing secrets such as database credentials, with built-in capabilities for automatic rotation according to a schedule (e.g., every 30 days). It integrates natively with supported databases (e.g., Amazon RDS, Redshift, DocumentDB) to rotate credentials without custom code, and it encrypts secrets at rest using AWS KMS. This makes it the correct choice for the developer's requirement of secure storage and automated rotation.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

AWS Identity and Access Management (IAM) roles for EC2.

Answer

AWS Key Management Service (KMS) to store the credentials as encrypted data.

Question 6

A company has multiple AWS accounts managed under AWS Organizations. The security team requires that all Amazon S3 buckets with bucket names containing 'logs' must be encrypted with a specific KMS key (key ID: alias/logs-key) at rest. A developer must enforce this using an SCP (Service Control Policy). Which SCP effect and condition key should be used to deny any PutObject request that does not use the required KMS key?

Accepted Answer

Deny effect with a Condition: StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id. Option A is correct because SCPs use a Deny effect to block non-compliant requests. The condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` ensures that any PutObject request that does not specify the exact KMS key alias/logs-key is denied. This enforces encryption with the required key for all S3 buckets containing 'logs' in their name.

Answer

Deny effect with a Condition: StringEquals on s3:x-amz-server-side-encryption

Answer

Allow effect with a Condition: StringEquals on kms:RequestTag/key-id

Answer

Deny effect with a Condition: IpAddress on aws:SourceIp

Question 7

A team wants to prevent secrets from being committed to source control and reduce blast radius if a secret is exposed. Which two practices help?

Accepted Answer

Use Secrets Manager or Parameter Store SecureString instead of source code. Option B is correct because AWS Secrets Manager and Systems Manager Parameter Store SecureString are purpose-built services for securely storing and managing secrets like database credentials and API keys. By using these services, secrets are never hardcoded in source code, eliminating the risk of accidental exposure through version control. This practice directly addresses the requirement to prevent secrets from being committed to source control.

Answer

Store production secrets in README files

Answer

Give all developers AdministratorAccess

Question 8

A company is developing a web application that runs on Amazon EC2 instances. The application needs to access an Amazon DynamoDB table to store and retrieve data. The security team requires that no IAM users or roles should be used; instead, the application must use temporary credentials that are automatically rotated. Which approach should the developer use to securely grant access to DynamoDB?

Accepted Answer

Launch the EC2 instance with an instance profile that has an IAM role attached. The IAM role should have a policy granting access to the DynamoDB table. The application uses the AWS SDK to obtain temporary credentials from the instance metadata service.. Option B is correct because it uses an IAM role attached to the EC2 instance via an instance profile, which allows the AWS SDK to automatically retrieve temporary credentials from the EC2 instance metadata service (IMDS). These credentials are rotated automatically by AWS, satisfying the security team's requirement for no long-lived IAM users or roles and ensuring secure, temporary access to DynamoDB.

Answer

Create an IAM user with access keys and store the keys in AWS Secrets Manager. Have the application retrieve the keys at runtime.

Answer

Use an AWS Lambda function to generate a pre-signed URL that allows access to DynamoDB, and have the EC2 instance use that URL.

Answer

Generate a long-lived API token using AWS KMS and embed it in the application code.

Question 9

A company runs an application on Amazon EC2 that needs to securely store database credentials. The security team requires that credentials be automatically rotated every 30 days to reduce the risk of compromise. The application must be able to retrieve the credentials at startup without storing them in code or configuration files. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule (e.g., every 30 days) without requiring custom code. The application can retrieve credentials at startup via the Secrets Manager API using IAM permissions, eliminating the need to store secrets in code or configuration files. Secrets Manager natively supports automatic rotation for Amazon RDS, Redshift, and DocumentDB, and can be extended to other services via custom Lambda functions.

Answer

AWS Systems Manager Parameter Store (SecureString)

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM) roles

Question 10

A company stores application logs in an Amazon S3 bucket. The security team requires that all objects uploaded to the bucket must be encrypted at rest using an AWS KMS key. The developer needs to enforce this by denying any PutObject request that does not use the required encryption. Which bucket policy condition should be used?

Accepted Answer

"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc". Option B is correct because the condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` allows you to enforce that a specific KMS key ARN is used for server-side encryption. By setting this condition to the exact KMS key ARN, any PutObject request that does not include the required `x-amz-server-side-encryption-aws-kms-key-id` header with the matching key ID will be denied, ensuring all objects are encrypted with the mandated KMS key.

Answer

"s3:x-amz-server-side-encryption": "aws:kms"

Answer

"s3:x-amz-server-side-encryption": "AES256"

Answer

"kms:EncryptionContext": "service:s3"

Question 11

A company wants to enforce that all IAM users use multi-factor authentication (MFA) when accessing the AWS Management Console. Which IAM policy condition key should be used in a policy attached to each user or group to deny access if MFA is not present?

Accepted Answer

aws:MultiFactorAuthPresent. The correct condition key is `aws:MultiAuthFactorPresent`, which is a boolean value that is `true` when the user has authenticated using a valid MFA device. By using this key in a `Deny` effect policy (often combined with `Bool` condition), you can block any API call or console access that does not include MFA authentication. This is the standard AWS approach to enforce MFA for console access.

Answer

aws:RequestedRegion

Answer

aws:SourceIp

Answer

aws:SecureTransport

Question 12

A company uses AWS Secrets Manager to store database credentials. The credentials must be automatically rotated every 30 days. The developer needs to configure rotation without exposing the secret to any IAM user directly. Which configuration steps should the developer take?

Accepted Answer

Create a Lambda function with rotation logic, attach an IAM role with permissions to read and update the secret, and configure Secrets Manager to invoke the function every 30 days.. Option B is correct because AWS Secrets Manager does not provide a built-in Lambda function for rotating database credentials; you must create your own Lambda function that contains the rotation logic (e.g., querying the database, creating a new credential, and updating the secret). The Lambda function must be attached to an IAM role with permissions to read and update the secret, and Secrets Manager invokes this function based on the rotation schedule (every 30 days). This ensures the secret is never exposed directly to any IAM user, as only the Lambda function interacts with the secret programmatically.

Answer

Enable automatic rotation and choose a rotation interval of 30 days. Secrets Manager will automatically rotate the secret using a built-in Lambda function.

Answer

Use AWS Certificate Manager (ACM) to rotate the secret automatically every 30 days.

Answer

Store the secret in AWS Systems Manager Parameter Store and set a schedule to rotate it using a CloudWatch Events rule.

Question 13

A company wants to enforce that all uploads to an Amazon S3 bucket must be encrypted using server-side encryption. The developer needs to write an IAM policy condition that denies any s3:PutObject request that does not include the server-side encryption header. Which IAM condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. Option A is correct because the `s3:x-amz-server-side-encryption` condition key matches the `x-amz-server-side-encryption` request header, which is used to specify server-side encryption (SSE-S3 or SSE-KMS) for S3 PutObject requests. By denying requests that do not include this header, the policy enforces that all uploads must be encrypted at rest using server-side encryption.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-acl

Answer

s3:x-amz-storage-class

Question 14

A company wants to restrict access to an Amazon S3 bucket so that only requests originating from a specific Amazon VPC are allowed. The bucket is in the same AWS account as the VPC. Which configuration should the developer implement?

Accepted Answer

Bucket policy with condition aws:SourceVpc. Option A is correct because the `aws:SourceVpc` condition key in an S3 bucket policy allows you to restrict access to requests originating from a specific VPC. This works in conjunction with a VPC endpoint for S3 (Gateway or Interface endpoint), which ensures that traffic from the VPC to S3 stays within the AWS network and does not traverse the public internet. The condition evaluates the VPC ID from which the request originates, providing a secure, network-level access control.

Answer

Bucket policy with condition aws:SourceIp

Answer

Bucket ACL with VPC ID

Answer

VPC Endpoint policy

Question 15

A company wants to ensure that no Amazon S3 buckets in the AWS account can be made publicly accessible, even if a bucket policy or ACL is later configured to allow public access. Which AWS feature should the developer enable to enforce this at the account level?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is the correct choice because it provides account-level settings that override any bucket-level policies or ACLs that would grant public access. When enabled at the account level, these settings apply to all current and future S3 buckets, effectively preventing any bucket from becoming publicly accessible regardless of subsequent configuration changes.

Answer

S3 Object Lock

Answer

S3 Transfer Acceleration

Answer

S3 Bucket Policy with Deny clause

Question 16

A developer has an AWS Lambda function that needs to read objects from an S3 bucket in another account. The Lambda function's execution role includes an IAM policy that allows s3:GetObject on the bucket. The bucket owner has added a bucket policy that grants s3:GetObject to the Lambda execution role. However, the Lambda function receives Access Denied errors. The S3 bucket uses SSE-KMS for encryption. What is the most likely cause?

Accepted Answer

The Lambda function does not have kms:Decrypt permission on the KMS key used by the bucket.. When an S3 bucket uses SSE-KMS, the Lambda function must have explicit kms:Decrypt permission on the KMS key to decrypt the object after s3:GetObject retrieves the encrypted data. Even though the bucket policy and execution role allow s3:GetObject, the missing KMS permission causes an Access Denied error because S3 returns the encrypted object and the Lambda runtime cannot decrypt it without the key.

Answer

The S3 bucket does not have versioning enabled.

Answer

The Lambda function's execution role does not have an explicit allow for s3:GetObject.

Answer

The Lambda function is not in the same AWS region as the S3 bucket.

Question 17

A developer is building a REST API with Amazon API Gateway and needs to authorize requests based on a custom JSON Web Token (JWT) that includes claims for user roles. Which authorization mechanism should the developer use?

Accepted Answer

Lambda authorizer. A Lambda authorizer (formerly known as a custom authorizer) is the correct choice because it allows the developer to validate a custom JWT and extract claims such as user roles directly within the Lambda function. This enables fine-grained authorization logic that can inspect the JWT payload, verify its signature using a custom or third-party key, and return an IAM policy based on the claims, which API Gateway then enforces for the incoming request.

Answer

IAM authorizer

Answer

Amazon Cognito user pools authorizer

Answer

API Gateway resource policy

Question 18

A developer is deploying a containerized application on Amazon ECS with the Fargate launch type. The application needs to read data from an Amazon S3 bucket. The developer wants to follow the principle of least privilege. How should the developer grant the necessary permissions to the ECS tasks?

Accepted Answer

Create an IAM task role and reference it in the task definition using the 'taskRoleArn' parameter.. Option B is correct because Amazon ECS with the Fargate launch type supports IAM task roles, which allow you to assign an IAM role to the ECS task itself. By referencing the IAM task role in the task definition using the 'taskRoleArn' parameter, the containerized application can securely obtain temporary credentials from the ECS container agent via the AWS STS service, adhering to the principle of least privilege without embedding long-lived credentials.

Answer

Store AWS access keys as environment variables in the task definition.

Answer

Create an IAM user and embed its credentials in the container image.

Answer

Use an S3 bucket policy that grants access based on the security group of the ECS tasks.

Question 19

A developer is creating a web application that uses Amazon Cognito for user authentication. The application needs to verify the identity of users before allowing access to the API. Which Cognito feature should the developer use?

Accepted Answer

User Pools. Amazon Cognito User Pools provide a fully managed identity and access management service specifically designed for user authentication and authorization in web and mobile applications. They handle user sign-up, sign-in, and identity verification through features like multi-factor authentication (MFA) and JSON Web Token (JWT) issuance, making them the correct choice for verifying user identity before granting API access.

Answer

Identity Pools

Answer

Cognito Sync

Answer

Cognito Events

Question 20

A developer is deploying an application on Amazon EC2 instances that need to securely retrieve secrets from AWS Secrets Manager. What is the MOST secure way to provide the necessary permissions without hardcoding credentials?

Accepted Answer

Attach an IAM role to the EC2 instance with permission to access Secrets Manager.. Attaching an IAM role to the EC2 instance is the most secure method because it leverages temporary security credentials obtained via the EC2 instance metadata service (IMDS). This eliminates the need to hardcode, embed, or store any long-term credentials on the instance, adhering to the AWS Well-Architected Framework's security pillar. The IAM role's policy grants the instance precise permissions to call Secrets Manager APIs like GetSecretValue, ensuring least privilege.

Answer

Store the secret in an environment variable.

Answer

Embed the secret in the application code.

Answer

Use a configuration file stored in S3 with bucket policy.