DVA-C02 Mock Exam 79 — 25 Questions

Question 1

A developer is troubleshooting an AccessDenied error when a Lambda function tries to write to CloudWatch Logs. The function's IAM role includes the following policy. Which TWO missing permissions are causing the error? (Choose TWO.)

Accepted Answer

logs:CreateLogStream. Option C is correct because a Lambda function must call logs:CreateLogStream before it can write log events to a specific log stream. Without this permission, the function cannot create a new log stream when one does not already exist, resulting in an AccessDenied error. Option E is correct because logs:PutLogEvents is the permission required to actually write log events to an existing log stream; without it, the function cannot send log data to CloudWatch Logs.

Answer

logs:DescribeLogStreams

Answer

logs:CreateLogGroup

Answer

logs:GetLogEvents

Question 2

A developer needs to grant an IAM user read-only access to an S3 bucket named 'my-bucket'. Which IAM policy statement should be attached?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::my-bucket","arn:aws:s3:::my-bucket/*"]}. Option B is correct because it grants read-only access by allowing the `s3:GetObject` action (to read objects) and the `s3:ListBucket` action (to list objects in the bucket). The resources are correctly specified: `arn:aws:s3:::my-bucket` for the bucket-level `ListBucket` action and `arn:aws:s3:::my-bucket/*` for the object-level `GetObject` action. This combination provides the minimal permissions needed for read-only access without allowing write or delete operations.

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Deny","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 3

A developer is creating an IAM policy for a Lambda function that needs to read from an SQS queue and write to a DynamoDB table. Which THREE permissions are required? (Select THREE.)

Accepted Answer

sqs:DeleteMessage. A is correct because the Lambda function must delete messages from the SQS queue after processing them to prevent them from being reprocessed. The sqs:DeleteMessage permission is required to call the DeleteMessage API, which removes the message from the queue using its receipt handle. Without this permission, the function would successfully receive and process the message but fail to delete it, causing the message to become visible again after the visibility timeout expires.

Answer

sqs:SendMessage

Answer

dynamodb:GetItem

Question 4

A developer needs to enforce encryption in transit for all traffic between an application and an RDS database. Which configuration should be used?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB parameter group.. Option D is correct because setting the 'require_secure_transport' parameter to 'ON' in the DB parameter group enforces TLS/SSL encryption for all connections to the RDS database. This ensures that data in transit between the application and the database is encrypted, meeting the requirement for encryption in transit.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Create a VPC peering connection between the application and database subnets.

Answer

Enable encryption at rest using AWS KMS.

Question 5

A company uses AWS IAM roles to grant permissions to EC2 instances. An application running on an instance fails to access an S3 bucket. The IAM role has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. What is the likely cause?

Accepted Answer

The policy does not include s3:ListBucket permission.. The IAM policy allows only `s3:GetObject` on objects within `my-bucket`, but the application likely needs to list the bucket's contents first (e.g., via `s3:ListBucket`) to know which objects to retrieve. Without `s3:ListBucket` permission on the bucket resource (`arn:aws:s3:::my-bucket`), any attempt to list objects (such as through the AWS CLI `aws s3 ls` or SDK operations like `listObjects`) will fail with an AccessDenied error, even though `GetObject` is allowed. This is a common oversight when granting S3 access, as listing is a separate action required for many operations.

Answer

The instance does not have an instance profile.

Answer

The trust policy of the role does not allow EC2 to assume it.

Answer

The IAM role is not attached to the EC2 instance.

Question 6

A company uses AWS CloudTrail to log all API calls. The security team wants to be notified immediately when an IAM user creates a new access key. Which solution is most efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and triggers a Lambda function to send an SNS notification.. Option B is correct because CloudWatch Events (now Amazon EventBridge) can directly match the CreateAccessKey API call from CloudTrail and trigger a Lambda function to send an SNS notification in near real-time. This is the most efficient solution as it avoids the overhead of log ingestion, metric filters, or periodic queries, providing immediate notification with minimal latency.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter with an alarm.

Answer

Enable CloudTrail log file validation and periodically check the logs.

Answer

Use Amazon Athena to query CloudTrail logs daily.

Question 7

What is required for the Lambda function to access the code in the S3 bucket?

Accepted Answer

The Lambda execution role must have s3:GetObject permission on the S3 bucket.. Lambda functions access code stored in S3 buckets using an IAM execution role. The execution role must include the `s3:GetObject` permission for the specific bucket and object path to allow the Lambda service to download the deployment package. Without this permission, the Lambda function will fail with an access denied error during initialization.

Answer

The S3 bucket policy must grant access to the Lambda service.

Answer

The Lambda function must be in a VPC with an S3 VPC endpoint.

Answer

The S3 bucket must be configured as a static website with CloudFront.

Question 8

A developer is configuring an S3 bucket to host a static website. The bucket policy allows public read access. However, users receive a 403 Forbidden error when accessing the website. What is the most likely cause?

Accepted Answer

The bucket has 'Block all public access' settings enabled.. Option C is correct because the 'Block all public access' settings in the S3 bucket's Permissions tab override any bucket policy that grants public read access. Even if the bucket policy explicitly allows s3:GetObject for Principal "*", enabling any of the four block public access settings (especially 'Block public access to buckets and objects granted through new public bucket policies' or 'Block public and cross-account access to buckets and objects through any public bucket policies') will cause S3 to reject all anonymous requests, resulting in a 403 Forbidden error when accessing the static website endpoint.

Answer

The bucket is located in a different AWS region than the website endpoint.

Answer

The bucket name does not match the domain name.

Answer

The bucket is not configured with CloudFront as a content delivery network.

Question 9

A developer is using AWS KMS to encrypt data in an S3 bucket. The developer wants to ensure that the S3 bucket uses server-side encryption with AWS KMS managed keys (SSE-KMS) by default. Which configuration should be applied?

Accepted Answer

Set the bucket's default encryption to SSE-KMS with a KMS key.. Option D is correct because setting the bucket's default encryption to SSE-KMS with a KMS key ensures that all objects uploaded to the S3 bucket are automatically encrypted using server-side encryption with AWS KMS managed keys (SSE-KMS). This configuration enforces encryption at rest without requiring the client to specify encryption headers in the request, meeting the requirement for default SSE-KMS encryption.

Answer

Add a bucket policy that denies PutObject without the 'x-amz-server-side-encryption' header set to 'aws:kms'.

Answer

Configure the bucket to use SSE-C with a customer-provided key.

Answer

Set the bucket's default encryption to SSE-S3.

Question 10

A developer is configuring a Lambda function to access a DynamoDB table in a VPC. Which TWO steps are required to ensure the Lambda function can securely access DynamoDB? (Select TWO.)

Accepted Answer

Attach the Lambda function to a VPC.. Option B is correct because attaching the Lambda function to a VPC allows it to access resources within the VPC, such as a DynamoDB table accessed via a VPC endpoint. Without VPC attachment, the Lambda function runs outside the VPC and cannot use VPC endpoints or security groups. Option C is correct because a VPC endpoint for DynamoDB (using AWS PrivateLink) enables private connectivity between the VPC and DynamoDB without traversing the public internet, which is required for secure access from a Lambda function in the VPC.

Answer

Configure a NAT gateway in the VPC.

Answer

Add a route to the DynamoDB service in the subnet's route table.

Answer

Assign a security group to the Lambda function that allows outbound traffic to DynamoDB.

Question 11

A security audit reveals that an S3 bucket is publicly accessible. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Which TWO actions should be taken to remediate this issue? (Select TWO.)

Accepted Answer

Remove the public access grant from the bucket ACL.. Option A is correct because the bucket ACL may still grant public access even if the bucket policy is the primary issue. Removing the public access grant from the ACL ensures that no anonymous principals have s3:GetObject permissions via ACLs, which is a separate access control mechanism from bucket policies. This is a direct remediation step to eliminate public read access.

Answer

Create an IAM user policy that denies s3:GetObject for anonymous users.

Answer

Enable versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 12

Given the IAM policy above, what is the effective permission for an IAM user?

Accepted Answer

Full access to the bucket except delete.. The IAM policy grants the user s3:GetObject and s3:ListBucket permissions, which allow reading objects and listing the bucket, but explicitly denies s3:DeleteObject. Since an explicit deny overrides any allow, the effective permission is full access except delete. Option D is correct because the user can perform all actions except deleting objects.

Answer

No access to the bucket.

Answer

Full access to the bucket including delete.

Answer

Read-only access to the bucket.

Question 13

A developer is designing a system that must meet PCI DSS compliance. Which THREE AWS services can help with logging and monitoring security events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it provides a centralized service for collecting, monitoring, and storing log data from various AWS resources and applications. For PCI DSS compliance, CloudWatch Logs can ingest security-related logs (e.g., from EC2, Lambda, or on-premises servers) and enable real-time monitoring, metric filters, and alarms to detect and respond to security events. It also supports log retention policies and encryption at rest using AWS KMS, which are required for audit trails under PCI DSS Requirement 10.

Answer

Amazon VPC Flow Logs

Answer

AWS Key Management Service (KMS)

Question 14

A developer needs to grant a Lambda function read-only access to an S3 bucket. Which IAM entity should be used to attach the permissions?

Accepted Answer

Create an IAM role with the necessary permissions and assign it to the Lambda function as the execution role.. Option D is correct because Lambda functions require an IAM role (execution role) to obtain temporary AWS credentials via the AWS Security Token Service (STS). This role must have a trust policy allowing Lambda to assume it, and an attached permissions policy granting read-only access to the S3 bucket. This is the standard and secure method for granting permissions to an AWS service like Lambda.

Answer

Create an IAM user and provide the credentials to the Lambda function.

Answer

Attach a resource-based policy to the S3 bucket.

Answer

Attach a policy to an IAM group and add the Lambda function to the group.

Question 15

An application running on an EC2 instance needs to access a DynamoDB table. The instance is in a private subnet. What is the most secure way to grant access without using long-lived credentials?

Accepted Answer

Create an IAM role with DynamoDB access and attach it to the EC2 instance profile.. Option C is correct because it uses an IAM role attached to the EC2 instance profile, which allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS). This eliminates the need for long-lived credentials and follows the principle of least privilege. The instance can securely access DynamoDB without storing any secrets on the instance.

Answer

Create a VPC endpoint for DynamoDB and attach a security group to allow access.

Answer

Store IAM user access keys in the application configuration file.

Answer

Use a security group to allow the EC2 instance to communicate with DynamoDB.

Question 16

A company uses AWS KMS to encrypt S3 objects. A developer needs to allow an IAM user to decrypt objects but not encrypt them. Which IAM policy action should be allowed?

Accepted Answer

kms:Decrypt. The correct action is `kms:Decrypt` because the developer's requirement is to allow an IAM user to decrypt S3 objects but not encrypt them. AWS KMS uses separate permissions for encryption and decryption operations; `kms:Decrypt` specifically grants the ability to decrypt ciphertext without granting any encryption capabilities. By allowing only this action, the user can decrypt objects encrypted with the KMS key but cannot encrypt new data or perform any key management operations.

Answer

kms:GenerateDataKey

Answer

kms:Encrypt

Answer

kms:ReEncrypt

Question 17

A company hosts a web application on EC2 instances behind an ALB. The application uses cookies to track user sessions. The security team is concerned about session hijacking. Which action should be taken to protect the cookies?

Accepted Answer

Set the Secure and HttpOnly flags on the session cookie.. Setting the Secure and HttpOnly flags on the session cookie is the correct action because the Secure flag ensures the cookie is only sent over HTTPS, preventing interception via man-in-the-middle attacks, while the HttpOnly flag prevents client-side scripts (e.g., JavaScript) from accessing the cookie, mitigating cross-site scripting (XSS)-based session hijacking. This directly addresses the security team's concern by hardening the cookie against common attack vectors without requiring architectural changes.

Answer

Enable encryption on the ALB using a custom SSL certificate.

Answer

Store session data in ElastiCache instead of cookies.

Answer

Use AWS WAF to block requests without a valid session cookie.

Question 18

A developer is using AWS Secrets Manager to rotate database credentials automatically. The rotation fails with the error 'The secret value is not valid JSON.' What is the most likely cause?

Accepted Answer

The secret value was stored as a plain string instead of a JSON object.. AWS Secrets Manager requires secret values to be stored as valid JSON objects when automatic rotation is configured. If the secret is stored as a plain string (e.g., a single password string without key-value pairs), the rotation function cannot parse it, resulting in the 'The secret value is not valid JSON' error. This is because the Lambda rotation function expects to read and write a JSON structure to manage the credentials during rotation.

Answer

The secret is in a different AWS region than the Lambda rotation function.

Answer

The secret name is not base64-encoded.

Answer

The secret does not have the correct version label.

Question 19

A developer has an IAM policy that allows 's3:GetObject' for a specific S3 bucket. However, when the developer tries to download an object using the AWS CLI, access is denied. What could be the issue?

Accepted Answer

The object is encrypted with SSE-KMS and the user lacks kms:Decrypt permission.. Option D is correct because when an S3 object is encrypted with SSE-KMS, the `s3:GetObject` permission alone is insufficient. The AWS CLI must also have `kms:Decrypt` permission on the KMS key used to encrypt the object. Without this, the S3 service cannot decrypt the object before returning it, resulting in an access denied error even though the S3 policy allows the GetObject action.

Answer

The bucket policy explicitly denies access to the user.

Answer

The bucket is in a different region than the CLI configuration.

Answer

The bucket ACL does not grant the user access.

Question 20

A developer wants to securely store API keys for a third-party service and retrieve them at runtime in a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and retrieving secrets such as API keys, database credentials, and OAuth tokens at runtime. It integrates natively with AWS Lambda via the AWS SDK, allowing developers to fetch secrets with minimal latency and without hardcoding sensitive values in code. Secrets Manager also supports automatic rotation of secrets using built-in or custom Lambda functions, which is critical for maintaining security compliance.

Answer

AWS CloudFormation

Answer

Amazon DynamoDB with encryption at rest

Answer

AWS Systems Manager Parameter Store

DVA-C02 Mock Exam 79 — 25 Questions

Exhibit

DVA-C02 Mock Exam 79 — 25 Questions

Exhibit