DVA-C02 Mock Exam 80 — 25 Questions

Question 1

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The bucket policy allows s3:GetObject for the instance's IAM role, but the application is still getting access denied errors. What is the MOST likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the IAM role.. The most likely cause is that the EC2 instance does not have an instance profile associated with the IAM role. Without an instance profile, the IAM role's credentials are not delivered to the instance metadata service, so the AWS SDK cannot assume the role to sign requests to S3. This results in access denied errors even though the bucket policy explicitly allows s3:GetObject for that role.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Answer

The S3 bucket is encrypted with SSE-KMS and the instance does not have kms:Decrypt permissions.

Answer

The S3 bucket has a block public access setting enabled.

Question 2

Refer to the exhibit. A developer runs the AWS CLI command to decrypt a file using a KMS key. The command fails with an AccessDeniedException. What is the most likely cause?

Accepted Answer

The IAM user 'DevUser' does not have the kms:Decrypt permission on the KMS key.. The AccessDeniedException indicates that the IAM user 'DevUser' lacks the required kms:Decrypt permission on the specified KMS key. KMS key policies and IAM policies work together to control access; without an explicit allow for kms:Decrypt on that key, the API call is denied regardless of other permissions.

Answer

The ciphertext blob is not base64-encoded.

Answer

The KMS key is disabled.

Answer

The KMS key ID is incorrect.

Question 3

A company requires that all data in an S3 bucket be encrypted at rest. The security team wants to enforce that only objects encrypted with AWS KMS are allowed. Which S3 bucket policy condition key should be used to deny PutObject requests if the object is not encrypted with KMS?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. Option D is correct because the `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key specifically checks for the AWS KMS key ID (or alias) used for server-side encryption with AWS KMS (SSE-KMS). By using this key in a bucket policy with a `Deny` effect, you can enforce that only objects encrypted with a specific KMS key are allowed, rejecting any `PutObject` request that does not include the required `x-amz-server-side-encryption-aws-kms-key-id` header.

Answer

s3:x-amz-server-side-encryption-key-id

Answer

s3:x-amz-server-side-encryption

Answer

s3:x-amz-server-side-encryption-kms-key-id

Question 4

A developer is troubleshooting an issue where an IAM user cannot perform 's3:ListBucket' on a bucket. Which TWO factors could cause this denial?

Accepted Answer

An explicit deny statement in the bucket policy.. Option B is correct because an explicit deny statement in a bucket policy overrides any allow that might exist from an IAM policy or other sources. AWS IAM evaluates all policies (identity-based and resource-based) and an explicit deny always takes precedence, effectively blocking the s3:ListBucket action regardless of other permissions.

Answer

The bucket is in a different region than the user's default region.

Answer

The bucket is encrypted with AWS KMS.

Answer

The user has a permissions boundary that does not include s3:ListBucket.

Question 5

Refer to the exhibit. An IAM policy allows s3:GetObject for a bucket only from a specific IP range. A developer accesses the bucket from a laptop with IP address 192.0.2.55, but access is denied. What is the most likely reason?

Accepted Answer

The request is made from an AWS service, such as the AWS Management Console, which does not use the laptop's public IP.. Option D is correct because when a request is made via the AWS Management Console, the console itself acts as an intermediary. The console's requests originate from AWS service IPs, not the user's laptop public IP. Therefore, the `aws:SourceIp` condition in the IAM policy evaluates against the console's IP, which is not in the allowed range, causing the denial even though the laptop's IP is valid.

Answer

The policy includes an explicit deny statement elsewhere.

Answer

The condition key should be 'aws:SourceIp' without the 'IpAddress' wrapper.

Answer

The laptop's IP address is not within the allowed range.

Question 6

A developer is designing a system to store sensitive user data in Amazon S3. The data must be encrypted at rest and the encryption keys must be rotated annually. Which services can be used to meet these requirements? (Choose THREE.)

Accepted Answer

Amazon S3 SSE-KMS. Amazon S3 SSE-KMS (Server-Side Encryption with AWS KMS managed keys) allows you to encrypt data at rest in S3 using customer master keys (CMKs) stored in AWS KMS. With SSE-KMS, you can enable automatic annual rotation of the CMK by configuring key rotation in AWS KMS, which meets the requirement for rotating encryption keys annually.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 7

A developer needs to securely store database credentials for a Lambda function. The credentials must be automatically rotated every 90 days. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is designed specifically for securely storing, managing, and automatically rotating database credentials and other secrets. It supports built-in rotation with AWS Lambda, allowing you to set a custom rotation interval (e.g., 90 days) without custom infrastructure. Secrets Manager also integrates natively with Amazon RDS, Redshift, and DocumentDB for automatic credential rotation.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon DynamoDB

Answer

AWS KMS

Question 8

An organization wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. The security team needs to deny any console access if MFA is not enabled. Which IAM policy statement should be used?

Accepted Answer

Deny action '*' if 'aws:MultiFactorAuthPresent' is false.. Option B is correct because it uses a Deny statement with the condition 'aws:MultiFactorAuthPresent' set to 'false', which explicitly blocks any action when MFA is not present. This is the standard approach to enforce MFA for console access, as it overrides any Allow policies by default. The Deny effect ensures that even if other policies grant access, the lack of MFA results in denial.

Answer

Deny action '*' unless 'aws:MultiFactorAuthPresent' is true.

Answer

Deny action '*' if 'aws:MultiFactorAuthPresent' is false using BoolIfExists.

Answer

Allow action '*' if 'aws:MultiFactorAuthPresent' is true.

Question 9

An application running on EC2 instances in an Auto Scaling group needs to access an S3 bucket. The security team wants to avoid storing long-term AWS credentials on the instances. Which approach should be used?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. Option B is correct because it uses an IAM role attached to an EC2 instance profile, which allows the EC2 instances to automatically obtain temporary security credentials from the AWS Security Token Service (STS). This approach eliminates the need to store long-term credentials on the instances, as the credentials are rotated automatically and are retrieved via the instance metadata service (IMDS).

Answer

Store the credentials in AWS Systems Manager Parameter Store and retrieve them in User Data.

Answer

Use an AWS Lambda function to generate temporary credentials and pass them to the instances.

Answer

Generate access keys for a dedicated IAM user and store them in a file on the AMI.

Question 10

A developer needs to grant an IAM user access to list objects in an S3 bucket named 'app-data'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::app-data"}. Option C is correct because the s3:ListBucket action is required to list the objects in an S3 bucket, and the resource ARN must specify the bucket itself (arn:aws:s3:::app-data) without a trailing /*. This grants permission to list the contents of the 'app-data' bucket, which is the exact requirement.

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::app-data/*"}

Question 11

A company wants to encrypt data at rest in Amazon S3 using server-side encryption. Which options are managed by AWS KMS? (Choose TWO.)

Accepted Answer

SSE-KMS. SSE-KMS (option B) is a server-side encryption option where AWS KMS manages the customer master key (CMK) used to encrypt S3 objects. Envelope encryption with KMS (option C) is the underlying mechanism used by SSE-KMS, where a data key is generated by KMS to encrypt the object, and that data key is then encrypted by the CMK. Both options involve AWS KMS managing the encryption keys, making them the correct choices for the question.

Answer

SSE-S3

Answer

SSE-C

Answer

Client-side encryption

Question 12

A developer needs to allow an EC2 instance to access a DynamoDB table. Which IAM entity should be attached to the EC2 instance?

Accepted Answer

IAM role. An IAM role is the correct entity to attach to an EC2 instance because it provides temporary security credentials via the AWS Security Token Service (STS) that the instance can assume. This allows the EC2 instance to securely access the DynamoDB table without embedding long-term access keys in the instance. The role is attached to the instance profile, which the EC2 instance metadata service (IMDS) uses to retrieve credentials automatically.

Answer

IAM group

Answer

IAM user

Answer

Resource-based policy on the DynamoDB table

Question 13

A developer is deploying a Lambda function that needs to write logs to CloudWatch Logs. The function's execution role has the AWSLambdaBasicExecutionRole managed policy attached. However, logs are not being written. What is the MOST likely reason?

Accepted Answer

The log group does not exist and the Lambda function cannot create it due to a resource-based policy.. The AWSLambdaBasicExecutionRole managed policy grants permissions to create log streams and write logs to CloudWatch Logs, but it does not grant the `logs:CreateLogGroup` permission. If the log group does not already exist, the Lambda function will fail to write logs because it cannot create the log group. A resource-based policy on the log group can further restrict creation, but the primary issue is the missing `logs:CreateLogGroup` permission in the execution role.

Answer

The Lambda function is using a customer-managed KMS key for log encryption.

Answer

The CloudWatch Logs agent is not installed on the Lambda execution environment.

Answer

The Lambda function's execution role does not have sufficient permissions.

Question 14

A developer is building a serverless application using AWS Lambda. The Lambda function needs to write logs to CloudWatch Logs. What is the recommended way to grant the necessary permissions?

Accepted Answer

Attach an IAM execution role with CloudWatch Logs permissions.. Option B is correct because AWS Lambda uses an IAM execution role to obtain temporary credentials for accessing other AWS services. To allow a Lambda function to write logs to CloudWatch Logs, you must attach an IAM role with a policy that includes permissions for the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. This is the standard and recommended security practice for granting permissions to Lambda functions.

Answer

Use AWS KMS to encrypt the log data and grant permissions.

Answer

Create a resource-based policy on the Lambda function.

Answer

Store AWS access keys in environment variables.

Question 15

A company is using Amazon S3 to store sensitive documents. The security team requires that all access to the bucket be logged for audit purposes. Which feature should be enabled?

Accepted Answer

S3 server access logging. S3 server access logging provides detailed records for requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. This feature logs all access at the object level, which directly meets the audit requirement for sensitive documents. It delivers log files to a target bucket in a standardized format, enabling security teams to analyze access patterns and detect unauthorized activity.

Answer

Amazon CloudWatch Logs

Answer

S3 Inventory

Answer

AWS CloudTrail

Question 16

A company uses AWS Secrets Manager to rotate database credentials for an RDS MySQL instance. The rotation Lambda function fails with the error: 'Secret is scheduled for deletion.' What is the MOST likely cause?

Accepted Answer

The secret has been marked for deletion and is in the waiting period.. The error 'Secret is scheduled for deletion' indicates that the secret has been marked for deletion and is currently in the mandatory waiting period (default 7 to 30 days). During this period, AWS Secrets Manager prevents any operations on the secret, including rotation, to ensure the deletion is intentional. The rotation Lambda function fails because it cannot access or modify a secret that is pending deletion.

Answer

The secret's rotation schedule has been disabled.

Answer

The Lambda function does not have permission to access the secret.

Answer

The RDS instance is not in the same VPC as the Lambda function.

Question 17

A developer is building a web application that uses Amazon Cognito for user authentication. Which TWO actions should be taken to secure the application?

Accepted Answer

Enable multi-factor authentication (MFA) for users.. Option A is correct because enabling multi-factor authentication (MFA) adds an extra layer of security beyond just a password, requiring users to provide a second factor (e.g., a one-time code from an authenticator app or SMS). This significantly reduces the risk of unauthorized access due to compromised credentials. Amazon Cognito supports MFA natively, allowing developers to enforce it for user pools.

Answer

Disable token expiration to avoid frequent re-authentication.

Answer

Use IAM users for authentication instead of Cognito.

Answer

Store user tokens in local storage for persistence.

Question 18

A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which THREE steps should be taken?

Accepted Answer

Add a condition in the key policy that allows decrypt only when the principal matches the desired IAM roles.. Option A is correct because key policies in AWS KMS are resource-based policies that directly control access to the CMK. By adding a condition that restricts the `kms:Decrypt` action to only specific IAM roles (using the `aws:PrincipalArn` or `kms:CallerPrincipal` condition key), the security team can ensure that only those roles can decrypt data encrypted with that key. This approach is more secure than relying solely on IAM policies, as key policies are evaluated first and can explicitly deny access even if an IAM policy grants it.

Answer

Grant all IAM users decrypt permission and rely on S3 bucket policies.

Answer

Use separate CMKs for each IAM role to isolate access.

Question 19

A developer needs to securely transfer files from an on-premises server to an S3 bucket. Which TWO methods meet the security requirements?

Accepted Answer

Use AWS Transfer Family with SFTP protocol.. Option B is correct because AWS Transfer Family provides a fully managed service that supports SFTP (SSH File Transfer Protocol) for securely transferring files to Amazon S3. It uses SSH for authentication and encryption, ensuring data in transit is protected without requiring any changes to the on-premises server's existing SFTP infrastructure.

Answer

Use the S3 sync command without any additional configuration.

Answer

Generate a presigned URL and use it with wget.

Answer

Use FTP with TLS.

Question 20

A developer is building a web application that must encrypt data in transit. Which AWS service should be used to manage SSL/TLS certificates?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it is specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services (e.g., Elastic Load Balancers, CloudFront, API Gateway). It handles the full lifecycle of certificates, including renewal, which directly addresses the requirement to encrypt data in transit using HTTPS.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS CloudHSM