DVA-C02 Security Practice Test 10 — 15 Questions

Question 1

A developer is designing a microservices architecture where each service communicates over HTTPS. They need to ensure that only authorized services can invoke each other. Which TWO services can be used to manage authentication and authorization between services?

Accepted Answer

AWS App Mesh. Option A and Option C are correct. AWS App Mesh provides service-to-service authentication using mTLS. AWS Resource Access Manager (RAM) is not correct. API Gateway can use IAM authorization or Lambda authorizers. VPC Lattice provides service-to-service authentication. AWS Direct Connect is for dedicated network connections.

Answer

AWS Resource Access Manager

Answer

AWS VPC Lattice

Answer

AWS Direct Connect

Question 2

A developer is storing secrets such as database passwords. Which TWO AWS services can be used to securely store and retrieve secrets?

Accepted Answer

AWS Systems Manager Parameter Store. Option B and Option D are correct. AWS Secrets Manager is designed for secrets with automatic rotation. AWS Systems Manager Parameter Store can store secrets in the Advanced tier with encryption. IAM is for identities. S3 is object storage. CloudHSM is a hardware security module.

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon S3

Question 3

A company wants to ensure that only encrypted connections are used to access their S3 bucket. Which THREE methods can be used to enforce this?

Accepted Answer

Use Amazon CloudFront with the S3 bucket as origin and require HTTPS.. Option A, Option C, and Option E are correct. A bucket policy with a condition on aws:SecureTransport denies HTTP. S3 Block Public Access does not enforce encryption. Default encryption sets server-side encryption but does not enforce HTTPS. CloudFront can enforce HTTPS. Client-side encryption encrypts data before sending.

Answer

Enable default encryption on the bucket.

Answer

Enable S3 Block Public Access on the bucket.

Question 4

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they can access objects in the S3 bucket from their office IP address (192.0.2.15) but cannot access from home (203.0.113.5). What is the most likely reason?

Accepted Answer

The policy restricts access based on source IP address.. Option A is correct because the policy includes an IP address condition that restricts access to the 192.0.2.0/24 range. Option B is wrong because the policy allows GetObject. Option C is wrong because the bucket name is correct. Option D is wrong because the condition is on source IP, not VPC.

Answer

The policy requires requests to originate from a VPC.

Answer

The bucket policy does not allow the user.

Answer

The policy denies all s3:GetObject actions.

Question 5

Refer to the exhibit. An IAM role has the attached policy. A developer is writing an application that will upload objects to the S3 bucket using server-side encryption with AWS KMS (SSE-KMS). The application is failing with an Access Denied error when trying to upload. What is the missing permission?

Accepted Answer

kms:Encrypt on the KMS key. Option C is correct because s3:PutObject with SSE-KMS requires kms:Encrypt on the KMS key. The policy allows kms:Decrypt and GenerateDataKey, but not Encrypt. Option A is wrong because kms:Decrypt is not needed for upload. Option B is wrong because kms:ListKeys is not required. Option D is wrong because the bucket name is correct.

Answer

kms:Decrypt on the KMS key

Answer

kms:ListKeys on the KMS key

Answer

s3:PutObjectAcl on the bucket

Question 6

Refer to the exhibit. A developer is trying to query a DynamoDB table from a Lambda function that uses an execution role named MyRole. The Lambda function is failing with the error shown. Which step should the developer take to resolve this?

Accepted Answer

Attach a policy to the Lambda execution role that allows dynamodb:Query on the table.. Option B is correct because the error indicates the role lacks dynamodb:Query permission. Option A is wrong because the error is about missing permission, not resource policy. Option C is wrong because the error is not about encryption. Option D is wrong because the error is not about KMS.

Answer

Enable DynamoDB encryption at rest.

Answer

Add a resource-based policy to the DynamoDB table allowing the Lambda role.

Answer

Grant the Lambda role kms:Decrypt permission on the KMS key.

Question 7

A developer is creating an IAM policy to allow an EC2 instance to access an S3 bucket. Which AWS service should the developer use to securely provide credentials to the EC2 instance?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. IAM roles are designed to be assumed by AWS services like EC2. Instance profiles deliver temporary credentials to the EC2 instance automatically, avoiding hard-coded keys. Option A is wrong because access keys are long-term and not recommended for EC2. Option C is wrong because Secrets Manager is for secrets, not EC2 instance credentials. Option D is wrong because Cognito is for user identity.

Answer

Use Amazon Cognito identity pools to generate temporary credentials for the instance.

Answer

Create an IAM user with access keys and store them on the instance.

Answer

Store the AWS access key in AWS Secrets Manager and retrieve it at runtime.

Question 8

A company uses AWS KMS to encrypt data at rest in S3. The security team wants to audit all use of the KMS key, including decryption operations. What should the developer enable?

Accepted Answer

Enable AWS CloudTrail with data events for the KMS key.. AWS CloudTrail logs all KMS API calls, including Decrypt, Encrypt, and GenerateDataKey. This provides the audit trail required. Option A is wrong because S3 server access logs do not include KMS operation details. Option C is wrong because CloudWatch Logs is for log storage, not for capturing API calls. Option D is wrong because AWS Config records resource configuration changes, not API calls.

Answer

Enable AWS Config rules to monitor key usage.

Answer

Enable S3 server access logging.

Answer

Create a CloudWatch Logs log group and stream KMS logs.

Question 9

A developer is building a serverless application with AWS Lambda that needs to read from an Amazon DynamoDB table. The Lambda function is in a VPC. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Attach an IAM role to the Lambda function that allows the necessary DynamoDB actions.. The best practice is to attach an IAM role to the Lambda function with a policy that grants only the required DynamoDB actions (e.g., GetItem, Query). Lambda does not require a VPC endpoint for DynamoDB if it has internet access via a NAT gateway, but the IAM role is essential. Option A is wrong because VPC endpoints are for private connectivity, not authorization. Option C is wrong because hard-coding keys is insecure. Option D is wrong because Lambda does not use instance profiles.

Answer

Create a VPC endpoint for DynamoDB and associate a security group.

Answer

Store DynamoDB credentials in AWS Secrets Manager and retrieve them in the Lambda code.

Answer

Use an EC2 instance profile attached to the Lambda function's execution environment.

Question 10

A developer needs to allow an IAM user to temporarily access an AWS account for 12 hours. The developer must not create long-term credentials. What should the developer use?

Accepted Answer

Use AWS STS to generate temporary security credentials for a role.. IAM Security Token Service (STS) can generate temporary credentials with a custom expiration. By creating a role and allowing the user to assume it with a session duration of 12 hours, the requirement is met. Option A is wrong because IAM users have long-term credentials. Option C is wrong because resource-based policies alone don't grant cross-account access with temporary credentials. Option D is wrong because Cognito is for end users.

Answer

Create an IAM user with a password and access keys.

Answer

Attach a resource-based policy to the account.

Answer

Use Amazon Cognito user pools to generate temporary access.

Question 11

A company is using AWS CodePipeline to deploy a web application. The pipeline must securely store and use database credentials. Which AWS service should the developer use to store the credentials and retrieve them during deployment?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is designed to store secrets like database passwords and supports automatic rotation. It integrates with CodePipeline via Lambda functions. Option A is wrong because SSM Parameter Store can store secrets but lacks native rotation for RDS. Option C is wrong because DynamoDB is not a secrets store. Option D is wrong because IAM roles are for AWS service access, not for storing database credentials.

Answer

IAM role attached to the CodePipeline service role.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Amazon DynamoDB with server-side encryption.

Question 12

A developer is deploying an application on EC2 that must access an S3 bucket. The developer wants to avoid hard-coding credentials. What is the MOST secure way to grant access?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. Creating an IAM role with an instance profile and assigning it to the EC2 instance is the most secure method. It provides temporary credentials automatically via the EC2 metadata service. Option A is wrong because storing keys in a config file is not secure. Option B is wrong because S3 bucket policies are resource-based and should be used in combination with IAM roles, but the primary method is the instance profile. Option D is wrong because environment variables can be read by processes and are less secure than instance profiles.

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP address.

Answer

Set the AWS credentials as environment variables in the user data script.

Answer

Store the AWS access key ID and secret access key in a configuration file on the instance.

Question 13

A developer needs to encrypt data in an S3 bucket. The company requires that the encryption key be managed by AWS but with the ability to audit key usage. Which S3 encryption option should the developer use?

Accepted Answer

Server-Side Encryption with AWS KMS (SSE-KMS).. SSE-KMS uses AWS KMS to manage the key and provides CloudTrail logs for key usage. SSE-S3 does not provide separate audit logs for key usage. SSE-C requires the customer to manage keys. Client-side encryption does not use S3 server-side encryption.

Answer

Client-side encryption.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3).

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C).

Question 14

A developer is using Amazon API Gateway with a Lambda authorizer to secure a REST API. The developer wants to pass user context from the authorizer to the backend Lambda function. How should the developer accomplish this?

Accepted Answer

Return a context object from the Lambda authorizer that maps to integration request parameters.. The Lambda authorizer returns an IAM policy and a context map. The context map is included in the integration request and passed to the backend. Option A is wrong because the principal ID is a single field, not a full context. Option C is wrong because the authorization token is the input, not the output. Option D is wrong because resource paths are not used to pass context.

Answer

Include the user context in the principal identifier returned by the authorizer.

Answer

Encode the user context in the authorization token.

Answer

Use a custom header that maps to a resource path parameter.

Question 15

A company has a multi-account architecture using AWS Organizations. The security team wants to centrally manage IAM policies that apply to all accounts. Which AWS feature should the developer use?

Accepted Answer

Service control policies (SCPs) in AWS Organizations.. S CPs are used in AWS Organizations to centrally control the maximum permissions for accounts. They affect all IAM users and roles in the member accounts. Option A is wrong because IAM roles are per-account. Option B is wrong because IAM policies are per-account. Option D is wrong because AWS Config is for compliance, not permission management.

Answer

IAM cross-account roles.

Answer

AWS Config conformance packs.

Answer

IAM policies attached to the root user.