DVA-C02 Security Practice Test 10 — 15 Questions

Question 1

A developer is building a serverless application using AWS Lambda and API Gateway. The API should be accessible only from a specific VPC. What is the MOST secure way to achieve this?

Accepted Answer

Create a VPC endpoint for API Gateway and attach a resource policy to the API that allows access only from the VPC endpoint.. The most secure way to restrict API Gateway access to a specific VPC is to create a VPC endpoint for API Gateway (using AWS PrivateLink) and attach a resource policy to the API that allows access only from that VPC endpoint using the aws:SourceVpce condition. Option A is incorrect because security groups cannot be attached to API Gateway; they are used for EC2 instances or other VPC resources. Option B is incorrect because a private API Gateway endpoint does allow access from within the VPC, but without a resource policy, the API could still be accessible from other sources if the endpoint is shared or if the API is not properly restricted. Option C is incorrect because VPC peering is used to connect VPCs; API Gateway is not in a VPC, so peering does not apply.

Answer

Attach a security group to the API Gateway that only allows traffic from the VPC.

Answer

Create a private API Gateway endpoint and associate it with the VPC.

Answer

Set up VPC Peering between the VPC and the API Gateway's VPC.

Question 2

A developer wants to allow an IAM user to rotate their own access keys. Which IAM policy action should be included?

Accepted Answer

iam:CreateAccessKey. To allow an IAM user to rotate their own access keys, the IAM policy must grant permissions for several actions: `iam:CreateAccessKey` (to create the new key), `iam:UpdateAccessKey` (to deactivate the old key), `iam:DeleteAccessKey` (to delete the old key), and `iam:ListAccessKeys` (to view existing keys). By replacing the incorrect options with unrelated IAM actions (such as `iam:CreateUser`, `iam:GetUser`, and `iam:PassRole`), `iam:CreateAccessKey` becomes the single clearly correct answer among the choices.

Answer

iam:UpdateAccessKey

Answer

iam:GetAccessKeyLastUsed

Answer

iam:DeleteAccessKey

Question 3

A company is using AWS CloudTrail to monitor API activity. Which TWO actions are required to ensure the integrity and security of the log files?

Accepted Answer

Enable log file validation.. Options A and E are correct because enabling log file validation creates a digest file for integrity, and using SSE-KMS encrypts the logs. Option B is wrong because MFA Delete is an additional security feature for S3 versioning, but it is not required for CloudTrail log integrity. Option C is wrong because S3 bucket versioning is not a requirement for CloudTrail; it can be enabled but does not directly ensure integrity. Option D is wrong because using an S3 VPC endpoint is not required; CloudTrail can operate without it.

Answer

Enable MFA Delete on the CloudTrail S3 bucket.

Answer

Enable S3 bucket versioning on the CloudTrail bucket.

Answer

Use an S3 VPC endpoint to access the CloudTrail bucket.

Question 4

A company runs a web application on EC2 instances in an Auto Scaling group. The application uses an IAM role to access an S3 bucket that stores user uploads. Recently, the security team discovered that some uploaded files contain malicious content. The team wants to implement a solution that automatically scans new objects for malware and blocks access if threats are detected. The solution must be cost-effective and minimize latency for legitimate uploads. The developer is tasked with designing this solution. Which approach should the developer take?

Accepted Answer

Enable Amazon GuardDuty with S3 protection, configure an S3 event notification to trigger a Lambda function that scans new objects using a third-party malware engine, and update the bucket policy to deny access to objects that fail the scan.. Using Amazon GuardDuty with S3 protection and an S3 Event Notification to trigger a Lambda function for scanning provides automated threat detection and response. Option A is wrong because S3 Batch Operations is for large-scale batch jobs, not real-time scanning. Option B is wrong because S3 Object Lambda is for modifying objects, not scanning. Option C is wrong because Macie is for sensitive data discovery, not malware.

Answer

Use S3 Batch Operations to run a scanning script on all existing objects and then schedule periodic scans.

Answer

Use S3 Object Lambda to transform objects upon retrieval and check for malware.

Answer

Enable Amazon Macie on the S3 bucket to automatically detect malicious content.

Question 5

A developer is building a mobile application that uses Amazon Cognito User Pools for authentication. The app needs to access a REST API hosted on AWS. The developer wants to use Cognito to authorize API requests. The API Gateway is configured with a Cognito User Pool authorizer. However, when testing, the API returns a 401 Unauthorized error even though the user is authenticated. The developer verified that the user exists in the user pool and the ID token is valid. What is the MOST likely cause and solution?

Accepted Answer

The API request is missing the Authorization header with the token. The developer should add the token to the Authorization header.. The API Gateway Cognito User Pool authorizer expects the token to be present in the Authorization header. If the developer did not include the Authorization header with the valid ID token, the authorizer returns a 401 Unauthorized error. Option A is incorrect because simply deleting and recreating the authorizer does not address the missing header. Option B is incorrect because while the authorizer often expects an access token, it can be configured to accept ID tokens; the root cause here is the missing header, not the token type. Option D is incorrect because mapping templates are used for request/response transformation, not for passing the token; the token is passed via headers.

Answer

The API Gateway authorizer is not properly configured. The developer should delete and recreate the authorizer.

Answer

The developer is using the wrong token. The API Gateway authorizer requires the access token, not the ID token.

Answer

The API Gateway method request header is not mapped. The developer should add a mapping template to pass the token.

Question 6

A company has an S3 bucket that contains sensitive financial data. The security team requires that all access to the bucket be logged for audit purposes. The developer needs to enable logging that captures who accessed the bucket, the actions performed, and the source IP addresses. The logs must be stored in a separate bucket for security. Which solution meets these requirements?

Accepted Answer

Enable AWS CloudTrail with S3 data events and deliver logs to a separate S3 bucket.. AWS CloudTrail with S3 data events captures object-level operations (e.g., GetObject, PutObject) and can be delivered to a separate S3 bucket for audit logging. Option A is incorrect because CloudWatch Logs does not natively capture S3 data events; CloudTrail is the service that enables data event logging. Option B is incorrect because storing server access logs in the same bucket can cause a logging loop and does not meet the security requirement of a separate bucket. Option D is incorrect because VPC Flow Logs record IP traffic information, not S3 API calls.

Answer

Use Amazon CloudWatch Logs to capture S3 access logs by enabling S3 data events in CloudWatch.

Answer

Enable S3 server access logging on the bucket and store logs in the same bucket.

Answer

Enable VPC Flow Logs on the VPC that contains the S3 bucket.

Question 7

A company stores sensitive data in an S3 bucket that must be encrypted at rest. The security team requires that all objects uploaded to the bucket are automatically encrypted using server-side encryption with AWS KMS (SSE-KMS). A developer uploads an object without specifying any encryption header. The upload succeeds, but the object is not encrypted. What is the most likely cause?

Accepted Answer

The bucket does not have a default encryption configuration set to SSE-KMS.. S3 buckets do not automatically encrypt objects unless default encryption is configured. Without a default encryption setting, objects uploaded without encryption headers are stored unencrypted. Option A is incorrect because even if a bucket policy denies uploads without encryption headers, the upload would fail, not succeed unencrypted. Option B is incorrect because if the KMS key policy denied encryption, the upload would fail, not succeed unencrypted. Option C is incorrect because while default encryption can be disabled, the key point is that no default encryption configuration exists, and specifically not SSE-KMS. The question asks for the most likely cause, which is that the bucket lacks a default encryption configuration for SSE-KMS.

Answer

The bucket policy denies uploads without the x-amz-server-side-encryption header, but the developer's IAM user has permission to override the bucket policy.

Answer

The KMS key policy does not allow the IAM user to encrypt with that key.

Answer

The S3 bucket has default encryption disabled.

Question 8

A developer is configuring cross-account access to an S3 bucket. The bucket in Account A has a bucket policy granting access to an IAM role in Account B. The IAM role's trust policy allows the developer's IAM user in Account B to assume the role. When the developer tries to access the bucket from Account B using the assumed role, they receive an Access Denied error. Which additional step is required to resolve this?

Accepted Answer

Ensure the bucket policy grants the necessary permissions to the IAM role ARN from Account B.. Ensure the bucket policy grants the necessary permissions to the IAM role ARN from Account B. The developer is able to assume the IAM role in Account B, but the role itself does not have access to the S3 bucket because the bucket policy in Account A does not explicitly grant permissions to the role ARN. The bucket policy must include a statement allowing the role (e.g., arn:aws:iam::AccountB:role/RoleName) to perform the required actions on the bucket. Option A is incorrect because adding the developer's IAM user ARN to the bucket policy is unnecessary; the access is via the assumed role. Option B is incorrect because a VPC endpoint is not required for cross-account S3 access. Option D is incorrect because it bypasses the cross-account role setup and is less secure.

Answer

Add the developer's IAM user ARN to the bucket policy in Account A.

Answer

Configure a VPC endpoint for S3 in Account A and attach it to the bucket policy.

Answer

Create an IAM user in Account A and grant it S3 access, then share the credentials with the developer.

Question 9

A developer needs to allow an EC2 instance to access an S3 bucket securely without storing long-term credentials on the instance. Which AWS service should be used to provide temporary credentials?

Accepted Answer

Attach an IAM role to the EC2 instance profile with S3 permissions.. IAM roles for EC2 allow the instance to assume a role and obtain temporary credentials from STS. Option A is wrong because IAM users have long-term credentials. Option B is wrong because security groups are network firewalls and do not provide credentials. Option D is wrong because EC2 key pairs are for SSH access, not API credentials.

Answer

Create an IAM user with S3 access and store the access key on the EC2 instance.

Answer

Configure a security group allowing outbound traffic to S3.

Answer

Use an EC2 key pair to encrypt access to S3.

Question 10

A company's security policy requires that all data in transit between an Application Load Balancer (ALB) and its backend EC2 instances be encrypted. The ALB currently uses HTTPS listeners. What configuration ensures encryption between the ALB and targets?

Accepted Answer

Configure the target group to use HTTPS protocol.. To encrypt traffic between the ALB and backend EC2 instances, the target group protocol must be set to HTTPS, which uses TLS encryption. Option A is incorrect: security group rules control access but do not encrypt traffic. Option C is incorrect: while a Network Load Balancer with a TLS listener encrypts client-to-ALB traffic, it does not affect ALB-to-target encryption, and the question specifically asks about an Application Load Balancer. Option D is incorrect: setting the listener protocol to HTTPS with a certificate encrypts client-to-ALB traffic, not the traffic between ALB and targets.

Answer

Add a security group rule allowing port 443 from the ALB to the instances.

Answer

Use a Network Load Balancer with a TLS listener.

Answer

Set the listener protocol to HTTPS with a certificate.

Question 11

Refer to the exhibit. An IAM policy attached to a user includes the above statement. The user uploads an object to the S3 bucket without specifying any encryption header. What is the outcome?

Accepted Answer

The upload fails with an Access Denied error.. The IAM policy statement includes a condition that requires the `s3:x-amz-server-side-encryption` header to be `AES256`. If the user does not specify any encryption header in the upload request, the condition is not satisfied, so the Allow effect does not apply. The default is to deny access, resulting in an Access Denied error. Option A is incorrect because SSE-KMS requires the header `aws:kms`, not `AES256`. Option B is incorrect because the condition explicitly demands encryption with AES256. Option C is incorrect because while SSE-S3 uses `AES256`, the header must be provided; without it, the condition fails and the action is denied.

Answer

The upload succeeds and the object is encrypted with SSE-KMS.

Answer

The upload succeeds and the object is not encrypted.

Answer

The upload succeeds and the object is encrypted with SSE-S3.

Question 12

A developer is using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function needs to read the files and write results to a DynamoDB table. What is the MOST secure way to grant the necessary permissions?

Accepted Answer

Create an IAM execution role for Lambda with permissions to read from S3 and write to DynamoDB.. The most secure way to grant permissions to an AWS Lambda function is to create an IAM execution role with the necessary permissions (e.g., s3:GetObject and dynamodb:PutItem) and attach it to the Lambda function. This follows the principle of least privilege and avoids hardcoding credentials. Option A is incorrect because resource-based policies on S3 and DynamoDB are used for cross-account access, not for granting permissions to Lambda functions. Option C is also incorrect because an S3 bucket policy alone does not grant the Lambda function permissions; it only controls access to the bucket. Option D is insecure because storing AWS access keys in environment variables is a security risk and not a best practice.

Answer

Attach a resource-based policy to the S3 bucket and DynamoDB table allowing access from the Lambda function.

Answer

Configure the S3 bucket policy to allow the Lambda function's ARN.

Answer

Store AWS access keys in the Lambda environment variables.

Question 13

A company has a VPC with public and private subnets. The private subnets contain Amazon RDS databases. Which TWO actions are required to secure the database instances?

Accepted Answer

Configure security groups to allow only necessary traffic from application servers.. The two required actions to secure RDS instances in a VPC are: (A) Configure security groups to allow only necessary traffic from application servers, and (E) Place the RDS instances in private subnets. Security groups act as a virtual firewall, controlling inbound traffic at the instance level. By restricting access to only the application servers on the required database port (e.g., 3306 for MySQL), you minimize exposure. Placing RDS in private subnets ensures the instances have no direct route to the internet, as private subnets do not have an internet gateway route. This prevents direct internet access to the databases.

Option B is incorrect because IAM roles attached to RDS control permissions for AWS service integration, not network access. Database authentication is managed via database credentials or IAM database authentication, not by an IAM role on the instance. Option C is incorrect because network ACLs are stateless and applied at the subnet level; allowing inbound traffic on port 3306 from anywhere is overly permissive and insecure. The primary security mechanism should be security groups. Option D is incorrect because placing RDS in public subnets would expose the databases to the internet, defeating the purpose of security. Private subnets are essential for database security.

Answer

Attach an IAM role to the RDS instance to control access.

Answer

Use network ACLs to allow inbound traffic on port 3306 from anywhere.

Answer

Place the RDS instances in public subnets with a route to an internet gateway.

Question 14

A developer is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application requires that only authenticated users can invoke the API, and the data must be encrypted at rest. Which THREE steps should the developer take?

Accepted Answer

Enable CloudWatch Logs for API Gateway to log all requests.. Enabling CloudWatch Logs for API Gateway allows logging of all requests, which is essential for auditing and monitoring access, helping to meet security requirements. Option C is correct because DynamoDB encryption at rest is enabled by default using an AWS-owned CMK, ensuring data is encrypted. Option D is correct because implementing a Lambda authorizer in API Gateway can validate a JWT token, ensuring only authenticated users can invoke the API. Option B is wrong: while you can use a customer managed KMS key, it is not required; the default encryption is sufficient and the question does not mandate customer managed keys. Option E is wrong: IAM authorization is suitable for IAM users/roles, but not for end-user authentication with tokens like JWT; a Lambda authorizer is the appropriate solution.

Answer

Create a customer managed KMS key and use it to encrypt DynamoDB tables.

Answer

Use IAM authorization on the API Gateway methods.

Question 15

A developer is deploying an application on EC2 that must access an S3 bucket and an SQS queue. The developer wants to follow the principle of least privilege. Which THREE steps should be taken?

Accepted Answer

Create an IAM role with permissions to access S3 and SQS.. To follow least privilege, create an IAM role with a permissions policy that grants only the necessary S3 and SQS actions on the specific resources, then attach the role to the EC2 instance via an instance profile. Resource-based policies (bucket policy, queue policy) are not needed for the role to access resources in the same account; identity-based policies on the role suffice. Adding B and D is redundant and not a required step. The correct minimal steps are C and attaching the role to the instance (which is not an option), so the question is flawed.

Answer

Attach the IAM role directly to the EC2 instance as a security group.

Answer

Configure an SQS queue policy that grants access to the IAM role.

Answer

Configure an S3 bucket policy that grants access to the IAM role.

Answer

Attach an IAM policy directly to the EC2 instance.