DVA-C02 Mock Exam 82 — 25 Questions

Question 1

Refer to the exhibit. A developer applies this IAM policy to an IAM user. What is the effective result when the user attempts to download an object from the 'confidential' folder in the 'my-company-data' bucket?

Accepted Answer

The user cannot download objects from the confidential folder due to the explicit Deny.. The correct answer is A because IAM policies follow an explicit deny override, meaning that even if an Allow statement grants access, an explicit Deny statement for the same action will take precedence. In this policy, the Deny statement explicitly denies s3:GetObject for the 'confidential' folder (using a condition with StringLike on the ARN), so the user cannot download objects from that folder regardless of the Allow statement.

Answer

The user can download objects from the confidential folder but cannot upload to it.

Answer

The user cannot download objects from any folder because the policy is invalid.

Answer

The user can download objects from the confidential folder because the Allow statement grants access.

Question 2

Refer to the exhibit. A developer runs the AWS CLI command to decrypt a file using a KMS key alias 'my-key' and receives the error shown. The developer has an IAM policy that allows 'kms:Decrypt' on 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...'. Which additional step is required to resolve this error?

Accepted Answer

Add the user's ARN to the KMS key policy with 'kms:Decrypt' permission.. The error occurs because the KMS key policy does not grant the user permission to decrypt using the key. Even though the user has an IAM policy allowing 'kms:Decrypt' on the key, KMS requires that the key policy explicitly allow IAM user permissions (or grant the user direct access) for IAM policies to take effect. By adding the user's ARN to the key policy with 'kms:Decrypt', the key policy grants the necessary access, resolving the error.

Answer

Attach a policy to the user that allows 'kms:DescribeKey' on the key.

Answer

Use the key ID instead of the alias in the command.

Answer

Enable IAM user permissions in the KMS key policy.

Question 3

A developer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. Which TWO additional checks should the developer perform to resolve the issue?

Accepted Answer

Check if the S3 bucket policy has an explicit deny statement that affects the EC2 instance.. Option B is correct because S3 bucket policies can explicitly deny access even if the IAM role attached to the EC2 instance grants s3:GetObject. An explicit deny in a bucket policy overrides any allow, so checking for such a deny statement is essential. Option E is correct because if the S3 bucket uses SSE-KMS encryption, the EC2 instance's IAM role must have kms:Decrypt permissions to decrypt the object; without it, GetObject requests will fail.

Answer

Check the network ACLs for the subnet.

Answer

Check if the EC2 instance is in a VPC with an S3 VPC endpoint configured.

Answer

Check the security group rules attached to the EC2 instance.

Question 4

A company needs to store application secrets such as database passwords and API keys. The secrets must be automatically rotated every 30 days. Which THREE AWS services or features can be used together to meet this requirement? (Choose THREE.)

Accepted Answer

AWS Lambda to implement the rotation function. AWS Lambda is correct because it can be used as a custom rotation function for AWS Secrets Manager. Secrets Manager natively supports automatic rotation using a Lambda function that updates the secret value in both the service and the database or third-party service. This allows the company to meet the 30-day rotation requirement by scheduling the Lambda function via a CloudWatch Events rule or Secrets Manager's built-in rotation schedule.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 5

A developer is tasked with encrypting data at rest for an Amazon RDS for MySQL database. The developer wants to use AWS KMS for key management. Which TWO configurations are valid? (Choose TWO.)

Accepted Answer

Create a customer managed KMS key and specify it when creating the DB instance.. Option A is correct because you can create a customer managed KMS key and specify it when creating the DB instance. Amazon RDS for MySQL supports encryption at rest using AWS KMS, and you can choose a customer managed key at launch time. This key is used to encrypt the DB instance's storage, automated backups, read replicas, and snapshots.

Answer

Enable encryption after the DB instance is created by modifying the DB instance.

Answer

Use S3 server-side encryption (SSE-S3) with the RDS instance.

Answer

Use an AWS owned KMS key for encryption.

Question 6

A developer is designing a CI/CD pipeline using AWS CodePipeline. The pipeline deploys a Lambda function. Which THREE practices should be followed to ensure security?

Accepted Answer

Use IAM roles for pipeline actions instead of access keys.. Option A is correct because IAM roles provide temporary credentials for AWS services, eliminating the need to manage long-term access keys. CodePipeline can assume an IAM role to perform actions like deploying a Lambda function, which reduces the risk of credential leakage. This follows the principle of least privilege and is a security best practice for automated pipelines.

Answer

Use CloudFront to distribute pipeline artifacts.

Answer

Encrypt artifacts in transit using TLS.

Question 7

A developer is deploying an application that uses Amazon SQS queues. The messages contain sensitive data that must be encrypted at rest. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the SQS queue to use a customer managed KMS key.. Option C is correct because configuring an SQS queue to use a customer managed KMS key gives you control over the key lifecycle, including rotation and access policies, while still leveraging AWS KMS for server-side encryption. Option D is also correct because enabling server-side encryption (SSE) for SQS using AWS KMS encrypts messages at rest automatically, without requiring client-side changes. Together, these two actions ensure that sensitive data in SQS messages is encrypted at rest using KMS, meeting the requirement.

Answer

Encrypt the messages client-side before sending to SQS.

Answer

Store the messages in an S3 bucket with default encryption instead of using SQS.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 8

A developer is using AWS Certificate Manager (ACM) to provision an SSL/TLS certificate for a website hosted on CloudFront. The certificate must be renewed automatically. What is the correct action?

Accepted Answer

ACM automatically renews the certificate if it uses DNS validation.. ACM automatically renews certificates that use DNS validation, provided the required DNS CNAME record remains in place. CloudFront supports ACM certificates in us-east-1, and ACM handles renewal without any manual intervention or additional infrastructure like Lambda functions.

Answer

The developer must configure a Lambda function to renew the certificate.

Answer

The certificate cannot be used with CloudFront; ACM certificates are only for ALB.

Answer

The developer must manually request a new certificate before expiration.

Question 9

Refer to the exhibit. A developer created an IAM role for a Lambda function. When the Lambda function invokes, it fails with an access denied error when trying to write logs to CloudWatch Logs. What is the most likely cause?

Accepted Answer

The role lacks a permissions policy that allows CloudWatch Logs actions.. Option C is correct because the Lambda function's IAM role must include a permissions policy that grants the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. Without these permissions, the Lambda runtime cannot write logs to CloudWatch Logs, resulting in an access denied error. The error occurs at invocation time when the Lambda service attempts to create or write to the log stream on behalf of the function.

Answer

The trust policy does not allow the Lambda service to assume the role.

Answer

The CloudWatch Logs log group has a resource-based policy that denies the Lambda function.

Answer

The Lambda function is not associated with this role.

Question 10

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role's trust policy allows the EC2 service, and the permissions policy grants s3:GetObject on the bucket. The application on the instance receives 'Access Denied' errors when trying to read objects. What is the most likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the IAM role.. The most likely cause is that the EC2 instance does not have an instance profile associated with the IAM role. An IAM role must be attached to an EC2 instance via an instance profile, which acts as a container for the role. Without this association, the instance cannot obtain temporary credentials from the AWS Security Token Service (STS) to sign API requests, resulting in 'Access Denied' errors even if the role's trust and permissions policies are correctly configured.

Answer

The IAM role's trust policy does not allow the EC2 service.

Answer

The S3 bucket has default encryption enabled.

Answer

The S3 bucket policy explicitly denies s3:GetObject.

Question 11

An application uses Amazon Cognito user pools for authentication. A developer wants to restrict access to an API Gateway endpoint to only authenticated users from a specific user pool. What is the best approach?

Accepted Answer

Use a Cognito User Pool authorizer in API Gateway.. Option B is correct because a Cognito User Pool authorizer in API Gateway is the native, fully managed way to restrict access to an API endpoint to authenticated users from a specific user pool. It automatically validates the JWT token issued by the user pool and caches the result, requiring no custom code. This approach integrates directly with API Gateway's authorization flow, ensuring only tokens from the specified user pool are accepted.

Answer

Attach an IAM policy to the API Gateway resource that allows only the Cognito user pool ARN.

Answer

Use an API Gateway resource policy that allows access only from the Cognito user pool.

Answer

Use a Lambda authorizer that validates the JWT token against the user pool.

Question 12

A developer needs to generate temporary credentials for a user to access an S3 bucket for 30 minutes. Which AWS service should be used?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the correct service for generating temporary, limited-privilege credentials to access AWS resources. It can issue credentials with a configurable expiration period, such as 30 minutes, via the AssumeRole API call. This directly meets the requirement for time-bound access to an S3 bucket.

Answer

IAM role

Answer

Amazon Cognito

Answer

AWS Key Management Service (KMS)

Question 13

An EC2 instance is running with an IAM instance profile. The application on the instance is trying to access an S3 bucket, but receives 'Access Denied'. The instance profile has a role with a policy that allows s3:GetObject on the bucket. What is a likely cause?

Accepted Answer

The instance is in a private subnet without a VPC endpoint for S3.. Option D is correct because when an EC2 instance is in a private subnet, it cannot reach the S3 public endpoint over the internet. Without a VPC endpoint (gateway or interface type) for S3, traffic to S3 is routed through a NAT device or internet gateway, which may be blocked by network ACLs or route tables. The 'Access Denied' error here is not due to IAM permissions but due to the network path being unavailable, causing the SDK to fail with a connectivity-related denial.

Answer

The instance profile is not attached to the instance.

Answer

The IAM role does not have the correct permissions.

Answer

The trust policy of the IAM role does not allow the EC2 service.

Question 14

A developer is troubleshooting an issue where an AWS Lambda function cannot write logs to Amazon CloudWatch Logs. The Lambda function has an execution role with a policy that allows logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Which additional configuration is likely missing?

Accepted Answer

The Lambda function is in a VPC without a VPC endpoint for CloudWatch Logs.. Option C is correct because when a Lambda function is attached to a VPC, it loses default internet connectivity, including the ability to reach the CloudWatch Logs API endpoints. Even if the execution role grants the necessary permissions, the function cannot send logs unless a VPC endpoint for CloudWatch Logs (com.amazonaws.region.logs) is created in the VPC, or the function has a NAT gateway to route traffic to the public endpoint.

Answer

The CloudWatch Logs log group is encrypted with a customer-managed KMS key.

Answer

The log group name must start with '/aws/lambda/'.

Answer

The Lambda function is not configured with a log group name.

Question 15

A company is designing a multi-account strategy using AWS Organizations. They want to enable cross-account access for developers using IAM roles. Each developer has an IAM user in the 'developers' account. The 'production' account has an IAM role 'AdminRole' that can be assumed by the 'developers' account. Which trust policy should be attached to 'AdminRole'?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]} where 123456789012 is the developers account ID.. Option A is correct because the trust policy on the 'AdminRole' in the production account must allow the entire 'developers' account (using its root ARN) to assume the role. When an IAM user in the developers account calls sts:AssumeRole, AWS evaluates the trust policy; specifying the root ARN of the developers account (arn:aws:iam::123456789012:root) delegates trust to the entire account, and the individual user's permissions are then controlled by an IAM policy attached to the user or a group that grants sts:AssumeRole for this role.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/*"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/AdminRole"},"Action":"sts:AssumeRole"}]}

Question 16

A developer runs a CloudTrail lookup command and sees a CreateKey event. What does this event represent?

Accepted Answer

A new KMS customer master key was created.. The `CreateKey` event in AWS CloudTrail indicates that a new KMS customer master key (CMK) was created. This is the only operation that generates a `CreateKey` event; key rotation, database encryption key creation, and service-linked key creation use different API calls (e.g., `RotateKey`, `CreateGrant`, or `CreateKey` with a different service principal).

Answer

An existing KMS key was rotated.

Answer

A new database encryption key was created.

Answer

A new service-linked key was created.

Question 17

A company uses AWS KMS to encrypt data in Amazon S3. They have a Customer Master Key (CMK) with key rotation enabled. The S3 bucket has default encryption using SSE-KMS with this CMK. An application writes objects to the bucket. Which statement about the encryption is correct?

Accepted Answer

The CMK is used to generate a data key that encrypts the object, and the encrypted data key is stored with the object.. Option A is correct because AWS KMS uses envelope encryption: when an object is written to S3 with SSE-KMS, KMS generates a unique data key from the CMK, encrypts the object with that data key, and then stores the encrypted data key alongside the object in S3. The CMK itself never directly encrypts the object data; it only encrypts the data key. This ensures that the CMK can be rotated without affecting the encrypted objects, as the encrypted data key remains decryptable by the new key material if the key ID is the same.

Answer

The CMK directly encrypts the object data.

Answer

When the CMK is rotated, all existing objects in the bucket are automatically re-encrypted with the new key.

Answer

Each object is encrypted with a unique data key that is stored alongside the object.

Question 18

Which TWO AWS services can be used to protect an application running on EC2 from common web exploits like SQL injection and cross-site scripting?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that helps protect web applications from common web exploits that could affect application availability, compromise security, or consume excessive resources. It allows you to create rules that filter and monitor HTTP(S) requests based on conditions such as IP addresses, HTTP headers, URI strings, and SQL injection or cross-site scripting patterns, making it the correct choice for protecting against these specific threats.

Answer

Amazon CloudWatch

Answer

Security Groups

Answer

AWS Identity and Access Management (IAM)

Question 19

An IAM policy is attached to a user. The user tries to delete an object in 'example-bucket' from IP address 198.51.100.5. What happens?

Accepted Answer

The user is denied from deleting the object.. The IAM policy includes an explicit Deny statement that denies the s3:DeleteObject action when the request originates from IP address 198.51.100.5. In AWS IAM, an explicit Deny overrides any Allow statement, so the user is denied from deleting the object regardless of any Allow permissions.

Answer

The user can delete the object because the Allow statement grants all actions on the bucket.

Answer

The user can delete the object because there is no explicit Deny for their IP.

Answer

The user can delete the object because the Deny condition is met.

Question 20

A company is implementing a CI/CD pipeline using AWS CodePipeline and CodeBuild. The pipeline deploys a serverless application. Which TWO actions should be taken to securely manage the database credentials used by the application?

Accepted Answer

Use AWS Lambda environment variables with encryption using a KMS key.. Option D is correct because AWS Lambda environment variables can be encrypted at rest using a KMS key, providing a secure way to store sensitive data like database credentials without hardcoding them in the function code. This approach ensures that the credentials are decrypted only when the Lambda function executes, and access to the KMS key can be controlled via IAM policies. Option E is also correct because AWS Secrets Manager is a dedicated service for managing secrets throughout their lifecycle, and CodeBuild can retrieve them securely using an IAM role with appropriate permissions, eliminating the need to store secrets in code or configuration files.

Answer

Embed the credentials in the Lambda function code.

Answer

Store the credentials in the buildspec.yml file in the CodeCommit repository.

Answer

Pass the credentials as CloudFormation parameters during deployment.

DVA-C02 Mock Exam 82 — 25 Questions

Exhibit

DVA-C02 Mock Exam 82 — 25 Questions

Exhibit