DVA-C02 Security Practice Test 12 — 15 Questions

Question 1

A company stores sensitive data in an S3 bucket. The security team requires that all data be encrypted at rest and in transit. Which THREE measures should be implemented?

Accepted Answer

Use HTTPS for all requests to S3. HTTPS encrypts data in transit between the client and S3 using TLS, ensuring confidentiality and integrity during transmission. This satisfies the requirement for encryption in transit, as HTTP requests would send data in plaintext.

Answer

Use client-side encryption

Answer

Enable MFA Delete on the bucket

Question 2

A developer is troubleshooting an AccessDenied error when a Lambda function tries to write to CloudWatch Logs. The function's IAM role includes the following policy. Which TWO missing permissions are causing the error? (Choose TWO.)

Accepted Answer

logs:CreateLogStream. A Lambda function must call logs:CreateLogStream before it can write log events to a specific log stream. Without this permission, the function cannot create a new log stream when one does not already exist, resulting in an AccessDenied error. Option E is correct because logs:PutLogEvents is the permission required to actually write log events to an existing log stream; without it, the function cannot send log data to CloudWatch Logs.

Answer

logs:DescribeLogStreams

Answer

logs:CreateLogGroup

Answer

logs:GetLogEvents

Question 3

A company wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which THREE actions are required?

Accepted Answer

Instruct users to use their MFA device when logging in. To enforce MFA for IAM users, three technical steps are required: 
1. Create an IAM policy that denies access to AWS services unless MFA is present (using the `aws:MultiFactorAuthPresent` condition).
2. Attach this IAM policy to the IAM users or groups to enforce the restriction.
3. Enable MFA for each IAM user (either via administrator setup or by allowing users to self-register their MFA devices).

Answer

Configure a password policy that requires MFA

Answer

Create a service control policy (SCP) to enforce MFA

Question 4

A company runs a containerized application on Amazon ECS using Fargate. The application needs to access an S3 bucket to read configuration files and a DynamoDB table to store session state. The ECS task role is configured with the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "dynamodb:PutItem",
        "dynamodb:GetItem"
      ],
      "Resource": "*"
    }
  ]
}

The application fails to read from the S3 bucket and write to DynamoDB. The error messages indicate AccessDenied. The S3 bucket has a bucket policy that denies all access unless the request includes a specific aws:SourceIp condition. The DynamoDB table has a resource-based policy that allows access only from the VPC endpoint. The ECS tasks are running in a private subnet with a VPC endpoint for DynamoDB but no VPC endpoint for S3. Which action should be taken to resolve the errors?

Accepted Answer

Create a VPC endpoint for S3 and modify the S3 bucket policy to allow access from the VPC endpoint. The application fails to read from S3 because there is no VPC endpoint for S3, and the bucket policy denies access unless a specific IP condition is met. Since a VPC endpoint for DynamoDB already exists and the table policy allows access from it, DynamoDB access succeeds. To resolve the S3 AccessDenied error, a VPC endpoint for S3 must be created, and the S3 bucket policy must be updated to allow access from this VPC endpoint.

Answer

Add s3:ListBucket to the task role policy and ensure the S3 bucket policy allows the task role ARN

Answer

Attach a NAT gateway to the private subnet and update the S3 bucket policy to allow the NAT gateway's public IP

Answer

Modify the task role policy to restrict resource ARNs to the specific S3 bucket and DynamoDB table

Question 5

A developer needs to grant an IAM user read-only access to an S3 bucket named 'my-bucket'. Which IAM policy statement should be attached?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::my-bucket","arn:aws:s3:::my-bucket/*"]}. It grants read-only access by allowing the `s3:GetObject` action (to read objects) and the `s3:ListBucket` action (to list objects in the bucket). The resources are correctly specified: `arn:aws:s3:::my-bucket` for the bucket-level `ListBucket` action and `arn:aws:s3:::my-bucket/*` for the object-level `GetObject` action. This combination provides the minimal permissions needed for read-only access without allowing write or delete operations.

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Deny","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 6

A company uses AWS IAM roles to grant permissions to EC2 instances. An application running on an instance fails to access an S3 bucket. The IAM role has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. What is the likely cause?

Accepted Answer

The trust policy of the role does not allow EC2 to assume it.. For an EC2 instance to successfully use an IAM role, the role must have a trust policy (trust relationship) that allows the Amazon EC2 service principal ('ec2.amazonaws.com') to perform the 'sts:AssumeRole' action. If this trust policy is missing or misconfigured, the EC2 instance cannot retrieve temporary credentials from the Instance Metadata Service (IMDS), causing all AWS API calls from the application to fail with an access or credential error, despite the attached IAM policy having the correct S3 permissions.

Answer

The instance does not have an instance profile.

Answer

The policy does not include s3:ListBucket permission.

Answer

The IAM role is not attached to the EC2 instance.

Question 7

A developer wants to securely store database credentials for a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is specifically designed for secure storage and automatic rotation of database credentials. Option B (Systems Manager Parameter Store) can store secrets but lacks native automatic rotation capabilities, making it less suitable for this use case. Option C (S3 with server-side encryption) is not a dedicated secrets store and would require additional access control management. Option D (DynamoDB) is a NoSQL database, not a secret management service, and would require custom encryption and rotation logic.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3 with server-side encryption

Answer

Amazon DynamoDB

Question 8

A company uses AWS CloudTrail to log all API calls. The security team wants to be notified immediately when an IAM user creates a new access key. Which solution is most efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and triggers a Lambda function to send an SNS notification.. CloudWatch Events (now Amazon EventBridge) can directly match the CreateAccessKey API call from CloudTrail and trigger a Lambda function to send an SNS notification in near real-time. This is the most efficient solution as it avoids the overhead of log ingestion, metric filters, or periodic queries, providing immediate notification with minimal latency.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter with an alarm.

Answer

Enable CloudTrail log file validation and periodically check the logs.

Answer

Use Amazon Athena to query CloudTrail logs daily.

Question 9

A developer is building a web application that must encrypt data in transit between the client and the server. Which AWS service should be used to offload SSL/TLS termination?

Accepted Answer

Application Load Balancer (ALB). An Application Load Balancer (ALB) is ideal for web applications (HTTP/HTTPS) to offload SSL/TLS termination. It decrypts HTTPS traffic from clients at Layer 7 and forwards it to backend targets, reducing CPU load on application servers and centralizing certificate management via AWS Certificate Manager (ACM). While Network Load Balancer (NLB) also supports TLS termination at Layer 4, ALB is specifically designed for HTTP/HTTPS application-level routing and features.

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53

Question 10

A developer is configuring a Lambda function to access a DynamoDB table in a VPC. Which TWO steps are required to ensure the Lambda function can securely access DynamoDB? (Select TWO.)

Accepted Answer

Attach the Lambda function to a VPC.. To allow a Lambda function inside a VPC to access DynamoDB without traversing the public internet, you must use a VPC gateway endpoint for DynamoDB. When you create a gateway endpoint, you must associate it with the route tables of the subnets where your Lambda function resides. This adds a route pointing to the DynamoDB prefix list (pl-xxxxxx) with the target as the VPC endpoint (vpce-xxxxxx). DynamoDB is a fully managed service and does not use security groups (ruling out E), and a NAT gateway (A) would route traffic over the public internet.

Answer

Configure a NAT gateway in the VPC.

Answer

Add a route to the DynamoDB service in the subnet's route table.

Answer

Assign a security group to the Lambda function that allows outbound traffic to DynamoDB.

Question 11

A security audit reveals that an S3 bucket is publicly accessible. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Which TWO actions should be taken to remediate this issue? (Select TWO.)

Accepted Answer

Remove the public access grant from the bucket ACL.. The bucket ACL may still grant public access even if the bucket policy is the primary issue. Removing the public access grant from the ACL ensures that no anonymous principals have s3:GetObject permissions via ACLs, which is a separate access control mechanism from bucket policies. This is a direct remediation step to eliminate public read access.

Answer

Create an IAM user policy that denies s3:GetObject for anonymous users.

Answer

Enable versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 12

A developer is creating an IAM policy for a Lambda function that needs to read from an SQS queue and write to a DynamoDB table. Which THREE permissions are required? (Select THREE.)

Accepted Answer

sqs:DeleteMessage. A is correct because the Lambda function must delete messages from the SQS queue after processing them to prevent them from being reprocessed. The sqs:DeleteMessage permission is required to call the DeleteMessage API, which removes the message from the queue using its receipt handle. Without this permission, the function would successfully receive and process the message but fail to delete it, causing the message to become visible again after the visibility timeout expires.

Answer

sqs:SendMessage

Answer

dynamodb:GetItem

Question 13

Given the IAM policy above, what is the effective permission for an IAM user?

Accepted Answer

Read-only access to the bucket.. The IAM policy grants only s3:GetObject and s3:ListBucket permissions, which allow reading objects and listing the bucket, and explicitly denies s3:DeleteObject. Since no write permissions (e.g., s3:PutObject) are granted, the effective permission is read-only access (list and get) with delete explicitly denied. Therefore, the user has read-only access to the bucket, not full access.

Answer

No access to the bucket.

Answer

Full access to the bucket including delete.

Answer

Full access to the bucket except delete.

Question 14

Based on the CloudTrail log entry, which security concern should be investigated?

Accepted Answer

Multi-factor authentication (MFA) was not used when assuming the role.. The stem asks the candidate to analyze a CloudTrail log entry, but the actual JSON or text of the log entry is missing from the question. Please provide the CloudTrail log entry in the stem so that candidates can evaluate the MFA status, source IP, region, or permissions.

Answer

The role used has too many permissions.

Answer

The instance was launched in an unauthorized region.

Answer

The source IP address is from a suspicious location.

Question 15

What is required for the Lambda function to access the code in the S3 bucket?

Accepted Answer

The Lambda execution role must have s3:GetObject permission on the S3 bucket.. To allow a Lambda function to access AWS resources like an S3 bucket during its execution, it must assume an IAM execution role with the appropriate permissions. To read an object from S3, the execution role must have the `s3:GetObject` permission for the target bucket and object path.

Answer

The S3 bucket policy must grant access to the Lambda service.

Answer

The Lambda function must be in a VPC with an S3 VPC endpoint.

Answer

The S3 bucket must be configured as a static website with CloudFront.