DVA-C02 Security Practice Test 11 — 15 Questions

Question 1

A company runs a web application on EC2 instances behind an Application Load Balancer. The security team discovers that the application is vulnerable to SQL injection attacks. The team wants to implement a web application firewall (WAF) to block these attacks. The architecture includes an ALB, EC2 instances in an Auto Scaling group, and an RDS database. The ALB currently has a listener on port 443 with an SSL certificate. The developer must integrate AWS WAF with minimal changes to the existing infrastructure. Which action should the developer take?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Associate AWS WAF directly with the Application Load Balancer.. AWS WAF can be directly associated with an Application Load Balancer (ALB) to filter HTTP/HTTPS requests and block SQL injection attacks. This requires minimal changes to the existing infrastructure because no additional components like CloudFront or agents are needed. Option A is incorrect because AWS Shield Advanced is a DDoS protection service, not a WAF, and does not include SQL injection rules. Option B is incorrect because WAF is a managed service that operates at the edge or load balancer level, not as an agent on EC2 instances. Option C is incorrect because while you could place CloudFront in front of the ALB and attach WAF to CloudFront, it adds unnecessary complexity and cost when the ALB already supports direct WAF association.

Answer

Subscribe to AWS Shield Advanced and enable automatic mitigation.

Answer

Install a WAF agent on each EC2 instance in the Auto Scaling group.

Answer

Place a CloudFront distribution in front of the ALB and associate WAF with CloudFront.

Question 2

A developer is managing an application that uses Amazon S3 to store user-uploaded images. The application generates thumbnails using AWS Lambda and stores them in a separate S3 bucket. The security team requires that all objects in both buckets be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). The developer has configured the Lambda function to use an IAM role with permissions to call KMS Encrypt and Decrypt. However, when a user uploads an image, the Lambda function fails to write the thumbnail with an 'Access Denied' error. The upload bucket has default encryption set to SSE-KMS. What is the MOST likely cause of the failure?

Accepted Answer

The Lambda execution role lacks kms:GenerateDataKey permission for the KMS key.. The Lambda function fails to write the thumbnail because it lacks the kms:GenerateDataKey permission. When writing an object with SSE-KMS, S3 calls GenerateDataKey to generate a data key for encryption. The Lambda execution role has Encrypt and Decrypt, but GenerateDataKey is required for writing objects encrypted with SSE-KMS. Option A is incorrect because VPC is not required for S3 access. Option B is incorrect because the issue is not a bucket policy; the Lambda role has permission to write but lacks the necessary KMS action. Option C is incorrect because default encryption on the upload bucket does not affect writing thumbnails to the output bucket. Therefore, the most likely cause is D: the Lambda execution role lacks kms:GenerateDataKey permission for the KMS key.

Answer

The Lambda function is not in a VPC that has access to the KMS key.

Answer

The output bucket does not have a bucket policy allowing the Lambda function to write.

Answer

The upload bucket's default encryption is not applied to objects uploaded by Lambda.

Question 3

A developer needs to share an S3 bucket with a third-party AWS account. The third-party will upload files to the bucket using their own IAM users. The developer creates a bucket policy that grants s3:PutObject to the third-party account's root user. However, the third-party reports that their IAM users cannot upload files. What is the MOST likely reason?

Accepted Answer

The third-party's IAM users do not have an IAM policy allowing s3:PutObject.. The bucket policy grants access to the root user, but the IAM users also need explicit permissions from their own account via an IAM policy. Option B is wrong because the bucket policy is not missing a condition; it's a permissions issue. Option C is wrong because the bucket policy grants PutObject to the root, but not to the users. Option D is wrong because S3 does not require user creation in the owning account for cross-account access.

Answer

The bucket policy must include a condition requiring encryption.

Answer

The bucket policy should grant access to the IAM user ARN instead of the root user.

Answer

The developer must create IAM users in their own account for the third-party.

Question 4

A developer is deploying a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party OIDC provider. The developer wants to minimize latency and avoid managing sessions. What is the BEST approach to achieve this?

Accepted Answer

Use Amazon Cognito User Pools with the OIDC identity provider and integrate with API Gateway.. The best approach is to use Amazon Cognito User Pools with the OIDC identity provider and integrate with API Gateway. This allows API Gateway to automatically validate tokens from the OIDC provider via Cognito User Pools, minimizing latency as validation is handled at the API Gateway level without custom code, and avoids session management. Option B (Lambda@Edge) would add complexity and latency as it runs at edge but still requires custom token validation. Option C (Cognito Identity Pools) is for granting AWS credentials, not for user authentication with OIDC. Option D (custom Lambda authorizer) introduces additional latency and management overhead compared to the native integration.

Answer

Use Lambda@Edge to validate tokens at CloudFront edge locations.

Answer

Use Amazon Cognito Identity Pools with the OIDC provider.

Answer

Implement a custom Lambda authorizer in API Gateway to validate tokens.

Question 5

A developer is building a web application that stores user session data in an ElastiCache Redis cluster. The cluster is in a VPC and is not publicly accessible. The developer needs to ensure that data in transit is encrypted. What should the developer do?

Accepted Answer

Enable encryption in transit on the ElastiCache Redis cluster.. ElastiCache for Redis supports encryption in transit, which encrypts data between the client and the Redis cluster. Placing an Application Load Balancer in front of the Redis cluster (Option B) is not supported; Redis uses a custom protocol that ALB cannot handle. Configuring security groups (Option C) controls network traffic but does not encrypt data. VPC peering (Option D) allows network connectivity but does not provide encryption in transit.

Answer

Place an Application Load Balancer in front of the Redis cluster and enable TLS termination.

Answer

Configure the security group to only allow traffic from the application servers.

Answer

Use VPC peering to connect the application VPC to the ElastiCache VPC.

Question 6

A company uses AWS Secrets Manager to rotate database credentials. The rotation process uses a Lambda function that updates the secret. The developer notices that the rotation sometimes fails because the Lambda function does not have permission to update the secret. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role does not have the necessary IAM permissions to update the secret.. The Lambda function's execution role must have IAM permissions to update the secret (e.g., secretsmanager:PutSecretValue). Without these permissions, the rotation will fail. Option A is incorrect because resource-based policies on secrets are not commonly denied to Lambda functions; the primary issue is the execution role. Option C is incorrect because KMS permissions are needed to decrypt the secret, but the update action itself requires IAM permissions on the secret. Option D is incorrect because VPC configuration does not affect IAM permissions; the Lambda can call Secrets Manager over the internet or via a VPC endpoint, but that is not the cause of permission failure.

Answer

The secret has a resource-based policy that denies the Lambda function.

Answer

The KMS key used to encrypt the secret is not accessible by the Lambda function.

Answer

The Lambda function is not in the same VPC as the Secrets Manager endpoint.

Question 7

A developer is deploying an application on Amazon ECS with Fargate. The application needs to access an S3 bucket that contains sensitive data. The developer wants to avoid storing AWS credentials in the container image. What is the MOST secure way to grant the application access to the S3 bucket?

Accepted Answer

Create an IAM task role with a policy that allows S3 access and specify it in the task definition.. An IAM task role for ECS tasks allows the container to assume the role without storing credentials. Option B is wrong because environment variables are not secure. Option C is wrong because mounting credentials in a volume is insecure. Option D is wrong because IAM instance profiles are for EC2 instances, not Fargate tasks.

Answer

Set the AWS credentials as environment variables in the task definition.

Answer

Store the credentials in an EFS volume and mount it to the container.

Answer

Use an IAM instance profile attached to the underlying EC2 instance.

Question 8

A developer needs to allow a user to deploy AWS CloudFormation stacks but restrict the user from creating or modifying IAM resources. Which IAM policy should the developer attach to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"cloudformation:*","Resource":"*"},{"Effect":"Deny","Action":"iam:*","Resource":"*"}]}. It grants full access to CloudFormation actions via an Allow statement while explicitly denying all IAM actions via a Deny statement, ensuring the user can deploy stacks but cannot create or modify IAM resources. Option B is incorrect because it allows all IAM actions, granting excessive permissions. Option C is incorrect because it allows CloudFormation but does not explicitly deny IAM, which could permit IAM actions if other policies allow. Option D is incorrect because it denies all CloudFormation actions, preventing stack deployment.

Answer

{"Effect":"Allow","Action":"iam:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"cloudformation:*","Resource":"*"}

Answer

{"Effect":"Deny","Action":"cloudformation:*","Resource":"*"}

Question 9

A company has an S3 bucket that stores log files. The bucket policy grants the AWSServiceRoleForSSO service role write access. However, the logs are not being written. What is the MOST likely reason?

Accepted Answer

The bucket policy uses a service role ARN that is not a valid principal for S3 bucket policies.. The bucket policy uses the ARN of the AWSServiceRoleForSSO service-linked role as the principal, but S3 bucket policies do not accept service role ARNs as valid principals. Instead, you must use the AWS service principal (e.g., sso.amazonaws.com) when granting permissions to an AWS service that uses a service role. Therefore, the policy fails to grant write access. Options A, C, and D are incorrect: S3 Block Public Access settings only block public access, not access from service roles; bucket ACLs are not effective when a bucket policy exists and private ACLs do not prevent authorized writes; default encryption with SSE-S3 does not block writes from any principal.

Answer

The bucket has S3 Block Public Access enabled, which blocks all service role access.

Answer

The bucket ACL is set to private, which prevents service role writes.

Answer

The bucket has default encryption enabled using SSE-S3, which prevents writes from service roles.

Question 10

A developer is designing a system that uses AWS KMS to encrypt data. Which of the following are valid ways to grant a user permission to decrypt data using a KMS key? (Select TWO.)

Accepted Answer

Use a resource-based policy on the KMS key that grants access to the user.. Options A and C are correct. A resource-based policy (key policy) on a KMS key can directly grant decrypt permission to a user (A). Additionally, you can attach an IAM policy to the user granting kms:Decrypt, provided the key policy allows access from the user's account (C). Option B is incorrect because KMS grants are intended for cross-account or temporary access, not as a primary method for granting user permissions within the same account. Option D is incorrect because S3 bucket policies cannot grant kms:Decrypt. Option E is incorrect because it grants permission to an IAM role, not directly to a user, and the question asks about granting a user permission.

Answer

Create a KMS grant that allows the user to decrypt the key.

Answer

Add a statement in the S3 bucket policy that allows kms:Decrypt for the user.

Answer

Add a statement in the key policy that allows the IAM role to perform kms:Decrypt.

Question 11

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application stores sensitive user data in an S3 bucket. A security audit reveals that the S3 bucket policy allows access from any AWS account. Which combination of actions should be taken to secure the bucket?

Accepted Answer

Modify the bucket policy to allow access only from the application's VPC endpoint or specific IAM roles. The question stem should be updated to ask for a single action instead of a combination of actions, as only Option C is correct.

Answer

Enable default encryption on the bucket

Answer

Enable S3 Block Public Access at the account level

Answer

Enable AWS CloudTrail to log bucket access

Question 12

A developer is configuring cross-account access for an S3 bucket. The source account (111111111111) wants to allow the target account (222222222222) to write objects to the bucket. The developer attaches the following bucket policy to the bucket in the source account:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::222222222222:root"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

However, the write operation fails with AccessDenied. What is the most likely cause?

Accepted Answer

The target account has not attached an IAM policy granting the user or role s3:PutObject. Cross-account S3 access requires both a bucket policy that grants the target account principal (or a resource-based policy) AND an IAM policy in the target account that explicitly allows the user or role to perform the s3:PutObject action. Without the target account's IAM policy, the request is denied even if the bucket policy permits it, as the target account's principal lacks the necessary permissions to make the call.

Answer

The bucket has an S3 ACL that denies the target account

Answer

The bucket policy does not allow s3:PutObject for the target account

Answer

The bucket is encrypted with SSE-KMS and the target account lacks KMS permissions

Question 13

A Lambda function needs to read from a DynamoDB table and send messages to an SQS queue. The function's IAM role should follow the principle of least privilege. Which policy statement should be attached to the role?

Accepted Answer

{"Effect":"Allow","Action":["dynamodb:GetItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}, {"Effect":"Allow","Action":["sqs:SendMessage"],"Resource":"arn:aws:sqs:us-east-1:123456789012:MyQueue"}. Option B is correct because it grants only the specific DynamoDB read action (GetItem) needed to read from the table and the specific SQS write action (SendMessage) needed to send messages to the queue, scoped to the exact resource ARNs. This adheres to the principle of least privilege by not allowing any unnecessary operations or resources. Wrapping the statements in an array makes the policy snippet syntactically valid.

Answer

{"Effect":"Allow","Action":["dynamodb:*"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}

Answer

{"Effect":"Allow","Action":["dynamodb:GetItem","sqs:SendMessage","sqs:ReceiveMessage"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem"],"Resource":"*"}

Question 14

A company wants to audit all API calls made in their AWS account for security analysis. Which TWO services should be used together to achieve this?

Accepted Answer

Amazon S3. AWS CloudTrail is the service that records all API calls made in an AWS account, capturing details like the identity of the caller, time of the call, source IP address, and request parameters. Amazon S3 is used as the secure, durable, and cost-effective storage destination where CloudTrail delivers these log files for long-term auditing and security analysis. Together, they provide the standard foundation for auditing API activity in AWS.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 15

A developer is designing a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party identity provider (IdP). Which TWO services can be used to manage user authentication?

Accepted Answer

Amazon Cognito User Pools. Amazon Cognito User Pools is a fully managed identity service that provides user sign-up, sign-in, and access control for web and mobile applications. It integrates directly with third-party identity providers (IdPs) such as Facebook, Google, or SAML-based providers, making it the correct choice for managing user authentication in a serverless application with API Gateway and Lambda.

Answer

AWS IAM

Answer

AWS Security Token Service (STS)

Answer

AWS Secrets Manager