DVA-C02 Mock Exam 75 — 25 Questions

Question 1

A developer is building an application that needs to read a secret API key from AWS Secrets Manager. The application runs on an EC2 instance that is part of an Auto Scaling group. The developer wants to ensure that only this application can retrieve the secret. Which set of steps should the developer take?

Accepted Answer

Store the secret in Secrets Manager, attach an IAM role to the EC2 instance that grants permission to read the secret, and configure the application to retrieve the secret using the AWS SDK. Option B is correct because it follows the principle of least privilege and uses IAM roles, which are the secure and recommended way to grant EC2 instances permissions to access AWS Secrets Manager. By attaching an IAM role to the EC2 instance, the application can securely retrieve the secret using the AWS SDK without embedding long-term credentials in code or configuration files. This ensures that only instances with that role can read the secret, and the credentials are automatically rotated by AWS.

Answer

Store the secret in Secrets Manager, create an IAM user with a policy to read the secret, and embed the user's credentials in the application code

Answer

Store the secret as an environment variable in the EC2 user data

Answer

Store the secret in a configuration file on the instance and restrict file permissions

Question 2

A developer needs to grant cross-account access to an Amazon S3 bucket. The developer's AWS account (Account A) owns the bucket, and a user in another account (Account B) needs to write objects to it. The developer has already added a bucket policy that grants the user in Account B permissions. What additional step is required?

Accepted Answer

The administrator of Account B must attach an IAM policy to the user that allows the required S3 actions.. Option B is correct because cross-account access to S3 requires both a resource-based policy (the bucket policy in Account A) and a user-based policy (an IAM identity-based policy in Account B). The bucket policy grants permissions to the Account B user, but that user cannot perform actions unless their own account explicitly allows those actions via an IAM policy. Without this, the request is denied by the user's own account's implicit deny, even if the bucket policy permits it.

Answer

No additional steps are needed; the bucket policy alone is sufficient.

Answer

Create a new IAM role in Account B and have the user assume the role.

Answer

Enable S3 ACLs on the bucket and grant write access to the Account B user.

Question 3

A developer stores database credentials for an application running on Amazon EC2. The security team requires that the credentials be automatically rotated every 30 days to reduce the risk of compromise. Which AWS service should the developer use to store and automatically rotate the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store database credentials and other secrets, and it provides built-in, configurable automatic rotation (e.g., every 30 days) using AWS Lambda. This meets the security team's requirement without custom scripting or infrastructure management.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

IAM Roles for EC2

Question 4

An application receives webhooks from a partner. The developer must verify that each request was signed by the partner and not modified in transit. What should the application validate?

Accepted Answer

The HMAC or digital signature over the payload using the shared/public key material. Option C is correct because webhook verification relies on validating a cryptographic signature (HMAC or digital signature) computed over the request payload using a pre-shared secret or public key. This ensures the payload was signed by the partner and has not been tampered with during transit, as any modification would invalidate the signature. The application must recompute the HMAC or verify the digital signature using the partner's public key and compare it to the signature provided in the request header.

Answer

The source port number

Answer

The CloudWatch log stream name

Answer

The API Gateway request ID only

Question 5

A developer is storing an API secret for a third-party service in AWS Secrets Manager. The secret needs to be accessed by an AWS Lambda function that runs in a VPC. The Lambda function must have the minimum required permissions. Which IAM policy statement should the developer attach to the Lambda execution role?

Accepted Answer

A policy that grants secretsmanager:GetSecretValue for the specific secret ARN and includes a condition for aws:SourceVpce to restrict access to the VPC endpoint. Option A is correct because it grants the minimum required permission (secretsmanager:GetSecretValue) scoped to the specific secret ARN, and uses the aws:SourceVpce condition key to restrict access to the VPC endpoint used by the Lambda function. This ensures that only requests originating from the specified VPC endpoint can retrieve the secret, aligning with the principle of least privilege and the requirement that the Lambda function runs in a VPC.

Answer

A policy that grants secretsmanager:GetSecretValue for all secrets in the account

Answer

A policy that grants secretsmanager:GetSecretValue for the secret and includes a condition for aws:SourceIp

Answer

A policy that grants secretsmanager:GetSecretValue for the secret and includes a condition for ec2:Vpc

Question 6

A developer stores database credentials in Secrets Manager. The application sometimes receives AccessDeniedException from Lambda after secret rotation. What should be checked first?

Accepted Answer

Whether the Lambda execution role and KMS key policy allow access to the new secret version and key. The AccessDeniedException from Lambda after secret rotation indicates that the Lambda function cannot access the new secret version. This is most commonly caused by the Lambda execution role lacking the necessary permissions (e.g., secretsmanager:GetSecretValue) for the new secret version ARN, or the KMS key policy not granting the Lambda role access to decrypt the secret using the customer-managed KMS key. Checking these two policies first is the correct troubleshooting step because rotation creates a new version with a different ARN, and the IAM policy must allow access to all versions or use a wildcard.

Answer

Whether API Gateway caching is enabled

Answer

Whether the VPC has exactly three subnets

Answer

Whether CloudFront invalidation completed

Question 7

A developer needs to store a database password for an AWS Lambda function. The password must be encrypted at rest with a customer-managed key that can be rotated manually. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Store the password in an encrypted Lambda environment variable using a customer-managed AWS KMS key. Option A is correct because storing the password in an encrypted Lambda environment variable using a customer-managed AWS KMS key meets the encryption-at-rest requirement with minimal operational overhead. Lambda natively integrates with KMS to encrypt environment variables at rest using a customer-managed key, and the key can be manually rotated via the AWS Management Console or API. This approach requires no additional services or infrastructure, keeping operational overhead low.

Answer

Store the password in AWS Systems Manager Parameter Store as a SecureString parameter

Answer

Store the password in AWS Secrets Manager and configure automatic rotation

Answer

Store the password in an Amazon S3 configuration file encrypted with server-side encryption

Question 8

A developer needs to ensure that every cryptographic operation performed on an AWS KMS customer master key (CMK) used for server-side encryption in Amazon S3 is recorded in AWS CloudTrail for auditing. The developer has already enabled CloudTrail and is logging management events. However, the security team wants to see all calls to the KMS Decrypt and Encrypt APIs for this specific key. What must the developer do?

Accepted Answer

Enable CloudTrail data events for the specific KMS key ARN.. Option C is correct because CloudTrail data events can be configured to log individual API operations (such as Decrypt and Encrypt) on specific KMS keys. By default, CloudTrail management events do not include these data-plane operations; enabling data events for the specific KMS key ARN ensures every cryptographic call is recorded for auditing.

Answer

Enable CloudTrail data events for the S3 bucket containing the encrypted objects.

Answer

Create an additional CloudTrail trail that logs all management events for the KMS key.

Answer

Enable CloudTrail Insights events on the existing trail.

Question 9

A developer needs to grant read-only access to objects in an S3 bucket (in Account A) to an IAM role in Account B. The bucket uses server-side encryption with AWS KMS (SSE-KMS) using a customer managed key (CMK) in Account A. Which of the following is REQUIRED for the cross-account access to succeed?

Accepted Answer

The S3 bucket policy in Account A grants s3:GetObject to the IAM role in Account B, the KMS key policy in Account A grants kms:Decrypt to the IAM role in Account B, and the IAM role in Account B has a trust policy allowing the IAM user to assume it.. Option A is correct because cross-account access to an S3 bucket with SSE-KMS using a customer managed key requires three distinct permissions: the S3 bucket policy must grant s3:GetObject to the IAM role in Account B, the KMS key policy must grant kms:Decrypt to that same role (since KMS key policies are resource-based and do not trust IAM policies from other accounts), and the IAM role in Account B must have a trust policy that allows the IAM user to assume it. Without the KMS key policy explicitly allowing the external role, the decryption step will fail, even if the S3 bucket policy permits the read operation.

Answer

The S3 bucket policy in Account A grants s3:GetObject to the IAM role in Account B, and the IAM role in Account B has a trust policy allowing the IAM user to assume it. No KMS key policy is needed because the role can use the key via IAM policies.

Answer

The S3 bucket policy in Account A grants s3:GetObject to the IAM user in Account B, and the IAM user's IAM policy grants s3:GetObject.

Answer

The S3 bucket uses SSE-C, so the developer must provide the encryption key in the request. No KMS key policy is needed.

Question 10

A developer wants to enforce that all requests to an Amazon S3 bucket must use HTTPS (TLS). The bucket is used for static website hosting. Which bucket policy condition should be used to deny requests that do not use HTTPS?

Accepted Answer

"aws:SecureTransport": "false". Option A is correct because the `aws:SecureTransport` condition key evaluates to `false` when the request is not sent over HTTPS (TLS). By using a Deny effect with this condition set to `false`, the policy blocks any HTTP requests to the S3 bucket, ensuring all traffic uses encrypted connections. This is a standard approach for enforcing TLS on S3 buckets, including those used for static website hosting.

Answer

"aws:SecureTransport": "true"

Answer

"aws:SourceVpc": "true"

Answer

"aws:Referer": "https"

Question 11

A Lambda function needs to decrypt data encrypted with a customer managed KMS key. Which two permissions are commonly required?

Accepted Answer

kms:Decrypt on the key. Option A is correct because the Lambda function must have permission to call the kms:Decrypt action on the specific customer managed KMS key to decrypt the data. This permission is granted via a key policy or a grant on the KMS key itself, allowing the Lambda execution role to use the key for decryption operations.

Answer

iam:CreateUser on the account

Answer

s3:PutBucketAcl on every bucket

Question 12

A Lambda function in a VPC must retrieve secrets from Secrets Manager without traversing the public internet. Which configuration should be used?

Accepted Answer

An interface VPC endpoint for Secrets Manager with appropriate security groups. An interface VPC endpoint (AWS PrivateLink) for Secrets Manager allows Lambda functions within a VPC to securely retrieve secrets using private IP addresses, without traversing the public internet. This is achieved by creating an elastic network interface in the VPC subnet with a security group that controls access, ensuring traffic stays within the AWS network.

Answer

A public NAT gateway only

Answer

An internet gateway attached to the Lambda subnet

Answer

A VPC peering connection to every AWS region

Question 13

A company stores sensitive documents in an Amazon S3 bucket. The security team requires that all objects uploaded must be encrypted at rest using a specific customer-managed AWS KMS key (key-id: 1234-5678). The developer must enforce this by denying any PutObject request that does not use the correct key. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id with value 'arn:aws:kms:us-east-1:123456789012:key/1234-5678'. Option B is correct because the condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` allows you to enforce that a specific customer-managed AWS KMS key (identified by its full ARN) is used for server-side encryption. By denying PutObject requests that do not match this key ID, the security team ensures all uploaded objects are encrypted at rest with the required KMS key.

Answer

s3:x-amz-server-side-encryption with value 'aws:kms'

Answer

s3:x-amz-acl with value 'bucket-owner-full-control'

Answer

aws:SourceArn with value the bucket ARN

Question 14

A company requires that all objects uploaded to an Amazon S3 bucket are encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). The developer wants to enforce this with a bucket policy. Which condition key and value should be used in the policy to deny uploads that do not meet this requirement?

Accepted Answer

s3:x-amz-server-side-encryption equals AES256. Option A is correct because the condition key `s3:x-amz-server-side-encryption` with value `AES256` directly checks that the request header `x-amz-server-side-encryption` is set to `AES256`, which is the required value for SSE-S3. By using this condition in a bucket policy with a Deny effect, any upload that does not include this header or includes a different value (e.g., `aws:kms`) will be rejected, enforcing server-side encryption with Amazon S3 managed keys.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id equals alias/aws/s3

Answer

aws:SecureTransport equals true

Answer

s3:object-lock-mode equals GOVERNANCE

Question 15

A company wants to store database credentials securely and rotate them automatically on a schedule. The credentials are used by an AWS Lambda function to access an Amazon RDS instance. Which AWS service should the developer use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule. It natively supports automatic rotation for Amazon RDS databases (including MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) by integrating with Lambda to update the credentials in both Secrets Manager and the RDS instance. This meets the requirement for both secure storage and scheduled rotation without custom infrastructure.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Certificate Manager (ACM)

Question 16

A company wants to enforce that all uploads to an Amazon S3 bucket must be encrypted using server-side encryption with a specific AWS KMS customer managed key (CMK). The developer needs to write an IAM policy condition that denies any s3:PutObject request that does not use the specified KMS key. Which IAM condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. Option C is correct because the `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that a specific AWS KMS customer managed key (CMK) ARN is used for server-side encryption on S3 PutObject requests. By using this condition key in a Deny statement, you can reject any upload that does not specify the required KMS key ID, ensuring encryption compliance.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

kms:KeyArn

Question 17

A company stores sensitive data in Amazon S3. The security team requires that all objects are encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). The developer needs to enforce that any PutObject request that does not specify the 'x-amz-server-side-encryption' header with value 'aws:kms' is denied. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption equals 'aws:kms'. Option A is correct because the condition key `s3:x-amz-server-side-encryption` in an S3 bucket policy can be used to require that the `x-amz-server-side-encryption` header is set to `aws:kms` on every PutObject request. This enforces server-side encryption with AWS KMS (SSE-KMS) at the bucket policy level, denying any request that omits or uses a different encryption header value.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id equals the KMS key ARN

Answer

s3:x-amz-acl equals 'bucket-owner-full-control'

Answer

s3:signatureversion equals 'AWS4-HMAC-SHA256'

Question 18

A developer is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application needs to encrypt data in transit between the client and the ALB. Which AWS service should be used to manage the SSL/TLS certificate?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it provisions, manages, and deploys public and private SSL/TLS certificates that can be associated with an Application Load Balancer (ALB) to encrypt data in transit between clients and the ALB. ACM handles certificate renewal automatically and integrates natively with ALB, removing the need for manual certificate management. This ensures HTTPS termination at the load balancer, securing the client-to-ALB communication.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 19

A company needs to grant another AWS account read-only access to an S3 bucket. The developer wants to use a bucket policy without requiring IAM users in the trusted account. Which resource-based policy statement should the developer add to the bucket?

Accepted Answer

A principal of 'arn:aws:iam::OTHER-ACCOUNT-ID:root' with s3:GetObject and s3:ListBucket.. Option D is correct because it uses the root user ARN of the trusted account as the principal, which effectively grants permissions to all IAM users and roles in that account. The s3:GetObject and s3:ListBucket actions provide the required read-only access. This approach allows cross-account access without needing to create IAM users in the trusted account, as the bucket policy is a resource-based policy that directly authorizes the principal.

Answer

A principal of the root user of the other account with s3:GetObject.

Answer

A principal of any user with a condition for the account ID.

Answer

A principal of the other account's root ARN with s3:ListBucket and s3:GetObject.

Question 20

A company has an Amazon S3 bucket that stores sensitive documents. The security team wants to ensure that all GET requests to the bucket are authenticated and that the requester does not have public access. Which combination of S3 features should the developer implement?

Accepted Answer

Block public access and enable S3 Access Points with a network origin policy. Option A is correct because blocking public access at the bucket level ensures that no anonymous or public requests can reach the bucket, while S3 Access Points with a network origin policy restrict access to requests originating from a specific VPC or on-premises network. This combination enforces that all GET requests must be authenticated (via the Access Point's IAM policies) and cannot come from public internet sources, meeting the security team's requirements.

Answer

Enable S3 Object Lock and versioning

Answer

Use S3 Transfer Acceleration and server-side encryption

Answer

Configure a bucket policy that allows only specific IAM users and enable MFA Delete