DVA-C02 Mock Exam 83 — 25 Questions

Question 1

A Lambda function needs to write logs to CloudWatch Logs. The developer attaches an IAM role with a policy that allows logs:CreateLogGroup and logs:PutLogEvents. However, logs are not appearing. What is the most likely cause?

Accepted Answer

The IAM policy does not include logs:CreateLogStream.. Lambda requires the `logs:CreateLogStream` permission to create a log stream within a log group before it can write log events. Without this permission, the function can create the log group but cannot create the individual log stream needed to store log entries, causing logs to silently fail to appear.

Answer

The Lambda function is not configured to use a VPC.

Answer

The IAM role does not have a trust policy that allows Lambda to assume it.

Answer

The CloudWatch Logs log group does not exist.

Question 2

A company uses an AWS Lambda function to process files uploaded to an S3 bucket. The Lambda function needs to read the files and write results to a DynamoDB table. The Lambda function is configured with an IAM role that has policies allowing s3:GetObject on the bucket and dynamodb:PutItem on the table. Despite correct permissions, the function fails with an AccessDenied error when trying to put items. What is the most likely cause?

Accepted Answer

The DynamoDB table has a resource-based policy that explicitly denies access to the Lambda function's IAM role.. The correct answer is B because DynamoDB tables can have resource-based policies that explicitly deny access even if the IAM role has the necessary permissions. Since explicit denies in resource-based policies override any allow in identity-based policies, the Lambda function's IAM role with dynamodb:PutItem permission is still blocked, causing the AccessDenied error.

Answer

The Lambda function is in a VPC without a VPC endpoint for DynamoDB.

Answer

The S3 bucket is in a different region, causing cross-region access issues.

Answer

The DynamoDB table is encrypted with a customer managed KMS key, and the Lambda role does not have kms:Decrypt permission.

Question 3

A developer needs to securely store database credentials for a Lambda function. The credentials should be automatically rotated every 30 days. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports native rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in Lambda rotation functions, and can be configured to rotate on a schedule (e.g., every 30 days) without custom code. The service also integrates directly with Lambda via the AWS SDK to retrieve secrets at runtime, ensuring credentials are never hardcoded.

Answer

AWS Key Management Service (KMS) to encrypt the credentials.

Answer

Store the credentials in an IAM role's trust policy.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Question 4

A company is using AWS KMS to encrypt data in S3. Which TWO actions are required to allow an IAM user to decrypt objects in a specific S3 bucket?

Accepted Answer

Attach a policy to the user allowing s3:GetObject on the bucket.. Option A is correct because to decrypt an object stored in S3 using server-side encryption with AWS KMS (SSE-KMS), the IAM user must have the s3:GetObject permission to retrieve the encrypted object from the bucket. Without this permission, the user cannot even initiate the GetObject request, regardless of KMS permissions.

Answer

Attach a policy to the user allowing kms:Encrypt.

Answer

Attach a policy to the user allowing s3:PutObject.

Answer

Attach a policy to the user allowing kms:GenerateDataKey.

Question 5

A company wants to securely store database credentials for a Lambda function. The credentials must be automatically rotated. Which TWO services should be used together?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials and other secrets. It integrates natively with AWS Lambda and supports automatic rotation via a built-in rotation function or a custom Lambda function, meeting the requirement for automated credential rotation without manual intervention.

Answer

AWS KMS

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 6

A company uses an S3 bucket to store sensitive customer data. The bucket policy currently allows access to a specific IAM role used by an EC2 instance. A security audit reveals that the bucket is also accessible from an external AWS account. Which action should the security team take to restrict access to only the intended role?

Accepted Answer

Add a condition in the bucket policy to allow access only when the request includes the specific IAM role ARN.. Option D is correct because adding a condition in the bucket policy using the `aws:PrincipalArn` condition key allows you to restrict access exclusively to the specific IAM role ARN. This ensures that even if the bucket policy grants access to an external AWS account, only requests made by the designated IAM role (e.g., `arn:aws:iam::123456789012:role/EC2AppRole`) will be allowed, effectively blocking any other principals, including those from external accounts.

Answer

Use S3 Object Ownership to disable ACLs.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Modify the IAM role trust policy to only allow the EC2 instance.

Question 7

A company wants to encrypt data at rest in an S3 bucket. Which AWS service can provide encryption keys that are managed by AWS and rotated automatically?

Accepted Answer

SSE-S3 (Server-Side Encryption with S3 Managed Keys). SSE-S3 uses encryption keys that are managed entirely by AWS and are rotated automatically on a regular basis. This option meets the requirement for AWS-managed keys with automatic rotation without any additional configuration or cost.

Answer

SSE-KMS (Server-Side Encryption with AWS KMS)

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys)

Answer

Client-side encryption using AWS KMS.

Question 8

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application needs to authenticate users using a third-party identity provider that supports SAML 2.0. The company wants to use AWS Identity and Access Management (IAM) to manage user permissions. Which solution should the developer implement?

Accepted Answer

Create an IAM identity provider for the SAML IdP and set up a role with a trust policy that allows federated users to assume it.. Option B is correct because it describes the standard AWS pattern for SAML 2.0 federation: creating an IAM identity provider for the external SAML IdP, then configuring an IAM role with a trust policy that allows users authenticated by that IdP to assume the role. This enables the application to use IAM to manage permissions for federated users without creating IAM users in the AWS account.

Answer

Use AWS Security Token Service (STS) to generate temporary credentials for the users.

Answer

Store the SAML metadata document in AWS Certificate Manager.

Answer

Use Amazon Cognito user pools with a SAML identity provider.

Question 9

A developer needs to temporarily grant an IAM user permissions to perform a specific task. The permissions should expire after 12 hours. Which approach should the developer use?

Accepted Answer

Use AWS STS to generate temporary security credentials.. AWS Security Token Service (STS) can generate temporary security credentials that are valid for a configurable duration, up to a maximum of 12 hours for IAM users. This allows the developer to grant permissions that automatically expire without manual intervention, meeting the requirement precisely.

Answer

Attach a policy to the user and detach it after 12 hours.

Answer

Use cross-account IAM roles.

Answer

Create a new IAM user with the required permissions and delete the user after 12 hours.

Question 10

A company is using an S3 bucket to store sensitive documents. They need to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. The bucket policy must enforce encryption by denying uploads that do not specify the required encryption. Which bucket policy statement should be added?

Accepted Answer

Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'aws:kms'. Option A is correct because the bucket policy uses the `s3:x-amz-server-side-encryption` condition key with `StringNotEquals` to deny any upload where the header does not specify `aws:kms`. This ensures that only objects encrypted with AWS KMS (SSE-KMS) are allowed, enforcing server-side encryption at rest. The `Deny` effect combined with this condition blocks requests that either omit the encryption header or specify a different value like `AES256`.

Answer

Condition: StringEquals: 's3:x-amz-server-side-encryption-aws:kms': 'true'

Answer

Condition: Null: 's3:x-amz-server-side-encryption': 'true'

Answer

Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'AES256'

Question 11

A developer is configuring an S3 bucket to host a static website. The bucket must be accessible to anyone on the internet, but only for reading objects. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Enable static website hosting on the bucket.. Option C is correct because enabling static website hosting on the S3 bucket is a prerequisite for serving content as a website. Without this setting, the bucket cannot serve HTTP requests for web pages, even if objects are publicly readable. This configuration provides an endpoint URL and allows index and error document routing.

Answer

Set the bucket ACL to public-read.

Answer

Create an Amazon CloudFront distribution with the bucket as origin.

Question 12

A developer needs to allow an IAM user to manage only their own access keys (create, list, update, delete). Which IAM policy statement achieves this?

Accepted Answer

{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/${aws:username}"}. Option A is correct because it uses the `iam:*AccessKey*` wildcard action to cover all access key management operations (create, list, update, delete) and restricts the resource to `arn:aws:iam::*:user/${aws:username}`. The `${aws:username}` policy variable dynamically resolves to the IAM user's own username, ensuring that each user can only manage their own access keys. This follows the principle of least privilege by scoping permissions to the user's own resource.

Answer

{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"arn:aws:iam::*:user/JohnDoe"}

Answer

{"Effect":"Allow","Action":"iam:*AccessKey*","Resource":"*"}

Answer

{"Effect":"Allow","Action":["iam:ListAccessKeys","iam:GetAccessKeyLastUsed"],"Resource":"*"}

Question 13

A developer is using CloudFront to serve content from an S3 bucket. The bucket contains sensitive data and should only be accessible through CloudFront. How can the developer enforce this?

Accepted Answer

Create an origin access identity (OAI) and grant it read access in the bucket policy.. Option D is correct because an Origin Access Identity (OAI) is a special CloudFront user that you can associate with your distribution. By configuring the S3 bucket policy to grant read access only to that OAI, you ensure that content can only be retrieved via CloudFront, not directly from the S3 endpoint. This enforces the requirement that the bucket is accessible exclusively through CloudFront.

Answer

Set the bucket policy to allow access only from CloudFront IP addresses.

Answer

Set the bucket policy to allow access only from AWS services.

Answer

Set the bucket policy to allow public read access and use CloudFront signed URLs.

Question 14

An application running on EC2 instances needs to access an S3 bucket securely. Which of the following is the BEST practice for managing credentials?

Accepted Answer

Launch the EC2 instance with an IAM role that grants S3 access.. Option C is correct because assigning an IAM role to an EC2 instance is the AWS-recommended best practice for securely granting permissions to AWS services. The instance automatically obtains temporary security credentials from the instance metadata service (IMDS), eliminating the need to hardcode or manage long-term access keys. This approach follows the principle of least privilege and avoids the security risks of storing credentials on disk.

Answer

Store the AWS access key and secret key in a configuration file on the EC2 instance.

Answer

Use an IAM user with programmatic access and attach a policy allowing S3 access.

Answer

Use a shared secret key stored in AWS Secrets Manager and retrieve it at runtime.

Question 15

Refer to the exhibit. An S3 bucket policy is set as shown. A developer tries to download an object from my-bucket using the AWS CLI from an IP address in the 203.0.113.0/24 range. What will happen?

Accepted Answer

The download fails with an AccessDenied error.. The correct answer is D because, in an S3 bucket policy, explicit Deny statements override any Allow statements. Even though the Allow statement grants s3:GetObject to all principals, the Deny statement explicitly denies s3:GetObject when the request originates from the 203.0.113.0/24 IP range. Since the developer's IP falls within that range, the Deny takes precedence, resulting in an AccessDenied error.

Answer

The policy is invalid because of conflicting statements.

Answer

The download succeeds because the Allow statement matches the request.

Answer

The download succeeds because the Deny statement does not apply to GetObject.

Question 16

Which THREE are valid methods to handle application configuration in AWS? (Choose three.)

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is a valid method for handling application configuration because it securely stores and manages sensitive configuration data such as database credentials, API keys, and other secrets. It supports automatic rotation of secrets, fine-grained access control via IAM policies, and integrates with AWS services like RDS, Redshift, and Lambda. This makes it ideal for managing dynamic configuration values that require high security and lifecycle management.

Answer

AWS CloudFormation template parameters

Answer

AWS IAM roles

Question 17

A company wants to use AWS KMS to encrypt data in an S3 bucket. They need to rotate the CMK annually. Which key type should they use to enable automatic rotation?

Accepted Answer

AWS managed key (aws/s3). AWS managed keys (aws/s3) support automatic annual rotation automatically without any configuration. When you use an AWS managed key for S3, AWS KMS rotates the key material once every year, which satisfies the requirement for annual rotation without manual intervention.

Answer

Customer managed key (CMK)

Answer

Custom key store

Answer

AWS owned key

Question 18

A company runs a serverless application using AWS Lambda and Amazon API Gateway. The application experiences intermittent 502 Bad Gateway errors. The Lambda function logs show no errors. What is the most likely cause?

Accepted Answer

The Lambda function execution time exceeds API Gateway's 29-second timeout.. The most likely cause is that the Lambda function execution time exceeds API Gateway's 29-second timeout. API Gateway has a hard limit of 29 seconds for integration responses, and if the Lambda function takes longer, API Gateway returns a 502 Bad Gateway error. Since the Lambda logs show no errors, the function is running successfully but timing out at the API Gateway level, not failing within Lambda itself.

Answer

The API Gateway account-level throttling limit is exceeded.

Answer

The Lambda function is throwing unhandled exceptions.

Answer

The API Gateway request payload exceeds 10 MB.

Question 19

Which TWO are best practices for optimizing DynamoDB performance? (Choose two.)

Accepted Answer

Use SQS to decouple write-heavy workloads and handle spikes.. Option A is correct because using SQS to decouple write-heavy workloads allows DynamoDB to absorb traffic spikes by buffering writes in a queue, preventing throttling and enabling batch processing. This pattern, often called 'queue-based load leveling,' ensures that DynamoDB's provisioned capacity is not overwhelmed by sudden bursts, improving overall system resilience and cost efficiency.

Answer

Provision maximum write capacity units to handle any spike.

Answer

Use Scan operations instead of Query for retrieving data.

Answer

Enable strongly consistent reads for all read operations.

Question 20

A developer reports that an AWS Lambda function is timing out after 3 seconds. The function reads from an Amazon SQS queue. What is the most likely cause?

Accepted Answer

The Lambda function timeout is set to 3 seconds, which is too low.. The Lambda function is timing out after exactly 3 seconds because its configured timeout is set to 3 seconds, which is too low for the workload. Lambda has a maximum execution timeout of 15 minutes (900 seconds), but the default timeout is 3 seconds. Since the function reads from an SQS queue, it likely needs more time to process messages, and increasing the timeout value will resolve the issue.

Answer

The Lambda function memory is set too low, causing slow execution.

Answer

The Lambda execution role lacks permissions to poll SQS.

Answer

The SQS queue is empty, causing the function to wait indefinitely.