DVA-C02 Security Practice Test 13 — 15 Questions

Question 1

A developer has an IAM policy that allows 's3:GetObject' for a specific S3 bucket. However, when the developer tries to download an object using the AWS CLI, access is denied. What could be the issue?

Accepted Answer

The object is encrypted with SSE-KMS and the user lacks kms:Decrypt permission.. When an S3 object is encrypted with SSE-KMS, the `s3:GetObject` permission alone is insufficient; the caller must also have `kms:Decrypt` permission for the KMS key. Option A is changed to 'The bucket policy does not explicitly grant access to the user' to serve as a strong distractor, because for same-account requests, an allow in either the IAM policy or the bucket policy is sufficient (both do not need to explicitly grant it).

Answer

The bucket policy explicitly denies access to the user.

Answer

The bucket is in a different region than the CLI configuration.

Answer

The bucket ACL does not grant the user access.

Question 2

A developer wants to securely store API keys for a third-party service and retrieve them at runtime in a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice when automatic rotation of secrets is required. AWS Systems Manager Parameter Store also securely stores API keys (using SecureString parameters) but does not support built-in automatic rotation for third-party API keys. Adding 'automatic rotation' to the stem makes Secrets Manager uniquely correct.

Answer

AWS CloudFormation

Answer

Amazon DynamoDB with encryption at rest

Answer

AWS Systems Manager Parameter Store

Question 3

A developer is designing a system that must meet PCI DSS compliance. Which THREE AWS services can help with logging and monitoring security events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it provides a centralized service for collecting, monitoring, and storing log data from various AWS resources and applications. For PCI DSS compliance, CloudWatch Logs can ingest security-related logs (e.g., from EC2, Lambda, or on-premises servers) and enable real-time monitoring, metric filters, and alarms to detect and respond to security events. It also supports log retention policies and encryption at rest using AWS KMS, which are required for audit trails under PCI DSS Requirement 10.

Answer

Amazon VPC Flow Logs

Answer

AWS Key Management Service (KMS)

Question 4

Which TWO actions should a developer take to securely manage database credentials in a serverless application?

Accepted Answer

Store credentials in AWS Secrets Manager and enable automatic rotation.. AWS Secrets Manager (Option A) securely stores database credentials and supports automatic rotation, which reduces the risk of credential exposure and eliminates the need for manual updates. IAM database authentication (Option B) allows passwordless authentication to Amazon RDS using IAM users or roles, eliminating the need to store or manage database credentials entirely. Storing credentials in deployment packages (Option C) or environment variables (Option D) is insecure. Security groups (Option E) control network access but do not manage credentials.

Answer

Store credentials in a text file within the Lambda deployment package.

Answer

Hardcode credentials in environment variables.

Answer

Use security groups to allow only the Lambda function to access the database.

Question 5

Which THREE practices help protect data at rest in Amazon S3?

Accepted Answer

Enable MFA Delete.. B is correct because enabling MFA Delete on an S3 bucket requires multi-factor authentication for permanent deletion of object versions, adding an extra layer of security to protect data at rest from accidental or malicious deletion. This directly safeguards the durability and integrity of stored data.

Answer

Enable versioning.

Answer

Enable cross-region replication.

Question 6

A developer is troubleshooting an issue where an IAM user cannot perform 's3:ListBucket' on a bucket. Which THREE factors could cause this denial?

Accepted Answer

An explicit deny statement in the bucket policy.. Options B, D, and E can all cause denial of s3:ListBucket. Option B: an explicit deny in a bucket policy overrides any allows. Option D: a permissions boundary defines the maximum permissions for the user; if s3:ListBucket is not included, it is effectively denied even if the user's IAM policy allows it. Option E: if the user's IAM policy does not include s3:ListBucket, they lack the necessary permission.

Answer

The bucket is in a different region than the user's default region.

Answer

The bucket is encrypted with AWS KMS.

Question 7

Refer to the exhibit. An IAM policy allows s3:GetObject for a bucket only from a specific IP range. A developer accesses the bucket from a laptop with IP address 192.0.2.55, but access is denied. What is the most likely reason?

Accepted Answer

The request is made from an AWS service, such as the AWS Management Console, which does not use the laptop's public IP.. When a request is made via the AWS Management Console, the console itself acts as an intermediary. The console's requests originate from AWS service IPs, not the user's laptop public IP. Therefore, the `aws:SourceIp` condition in the IAM policy evaluates against the console's IP, which is not in the allowed range, causing the denial even though the laptop's IP is valid.

Answer

The policy includes an explicit deny statement elsewhere.

Answer

The condition key should be 'aws:SourceIp' without the 'IpAddress' wrapper.

Answer

The laptop's IP address is not within the allowed range.

Question 8

Refer to the exhibit. A developer runs the AWS CLI command to decrypt a file using a KMS key. The command fails with an AccessDeniedException. What is the most likely cause?

Accepted Answer

The IAM user 'DevUser' does not have the kms:Decrypt permission on the KMS key.. An AccessDeniedException indicates that the IAM identity (user or role) making the request lacks the required kms:Decrypt permission on the specified KMS key. KMS key policies and IAM policies must both allow the action for the call to succeed.

Answer

The ciphertext blob is not base64-encoded.

Answer

The KMS key is disabled.

Answer

The KMS key ID is incorrect.

Question 9

An organization wants to enforce that all IAM users must use multi-factor authentication (MFA) to access the AWS Management Console. The security team needs to deny any console access if MFA is not enabled. Which IAM policy statement should be used?

Accepted Answer

Deny action '*' if 'aws:MultiFactorAuthPresent' is false.. It uses a Deny statement with the condition 'aws:MultiFactorAuthPresent' set to 'false', which explicitly blocks any action when MFA is not present. This is the standard approach to enforce MFA for console access, as it overrides any Allow policies by default. The Deny effect ensures that even if other policies grant access, the lack of MFA results in denial.

Answer

Deny action '*' unless 'aws:MultiFactorAuthPresent' is true.

Answer

Deny action '*' if 'aws:MultiFactorAuthPresent' is false using BoolIfExists.

Answer

Allow action '*' if 'aws:MultiFactorAuthPresent' is true.

Question 10

A company is using Amazon S3 to store sensitive documents. The security team requires that all access to the bucket be logged for audit purposes, but the company wants to avoid AWS CloudTrail data event charges and needs detailed HTTP request/response records. Which feature should be enabled?

Accepted Answer

S3 server access logging. S3 server access logging provides detailed records for requests made to an S3 bucket, including the requester, bucket name, request time, action, and response status. Unlike AWS CloudTrail data events, which incur additional charges per 100,000 events, S3 server access logging is free to enable (you only pay for the storage of the log files). This makes it the ideal choice for detailed HTTP-level logging without extra service costs.

Answer

Amazon CloudWatch Logs

Answer

S3 Inventory

Answer

AWS CloudTrail

Question 11

A developer is designing a system to store sensitive user data in Amazon S3. The data must be encrypted at rest and the encryption keys must be rotated annually. Which services can be used to meet these requirements? (Choose TWO.)

Accepted Answer

Amazon S3 SSE-KMS. Amazon S3 SSE-KMS (Server-Side Encryption with AWS KMS) encrypts data at rest in S3 using customer master keys (CMKs) stored in AWS KMS. AWS KMS supports automatic annual key rotation, fulfilling the key rotation requirement. AWS KMS itself is the service that manages the CMKs and provides the rotation feature. AWS Secrets Manager is used for storing secrets, not for encrypting S3 data. AWS Certificate Manager (ACM) and AWS CloudHSM do not provide S3 encryption with automatic annual key rotation.

Answer

AWS Secrets Manager

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 12

Which of the following are valid ways to secure access to an Amazon S3 bucket? (Choose TWO.)

Accepted Answer

Bucket policies. Bucket policies are a form of resource-based policy that you attach directly to an S3 bucket. They allow you to grant or deny access to the bucket and its objects for principals (users, roles, or AWS accounts) using the AWS JSON policy language. This is a primary and native way to control access to S3 resources, making option A correct.

Answer

CloudFront distribution

Answer

Network ACLs

Answer

Security groups

Question 13

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The bucket policy allows s3:GetObject for the instance's IAM role, but the application is still getting access denied errors. What is the MOST likely cause?

Accepted Answer

The S3 bucket is encrypted with SSE-KMS and the instance does not have kms:Decrypt permissions.. When an S3 bucket is encrypted using SSE-KMS, any entity attempting to retrieve an object (s3:GetObject) must also have permission to decrypt the object using the KMS key (kms:Decrypt). If the IAM role has the correct S3 permissions but lacks the kms:Decrypt permission on the KMS key, AWS S3 will return an 'Access Denied' error.

Why other options are incorrect:
- A: Security group restrictions on outbound traffic would cause the connection to time out, not return an 'Access Denied' error.
- C: Block Public Access settings prevent anonymous/public access, but access via an authorized IAM role is not public access.
- D: If the EC2 instance did not have an instance profile associated, the AWS SDK would fail locally with a credentials lookup error (e.g., 'Unable to locate credentials') rather than receiving an 'Access Denied' response from the S3 service.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Answer

The S3 bucket has a block public access setting enabled.

Answer

The EC2 instance does not have an instance profile associated with the IAM role.

Question 14

A company is using AWS CodeCommit and wants to ensure that all commits are signed with GPG keys. Which approach should be used to enforce this?

Accepted Answer

Enable 'Require signed commits' in the CodeCommit repository settings.. To restrict or deny pushes to a specific branch (such as 'main') in AWS CodeCommit, you must use an IAM policy with the `codecommit:referencedRefName` condition key. CodeCommit does not have a native 'branch protection' toggle in its settings like GitHub or GitLab, nor does it support server-side pre-commit hooks (Lambda triggers in CodeCommit run asynchronously after the push event has completed).

Answer

Use AWS Organizations service control policies (SCPs) to deny unsigned commits.

Answer

Create an IAM policy that denies codecommit:GitPush unless the commit is signed.

Answer

Use an AWS Lambda function as a pre-commit hook in the repository.

Question 15

A developer is deploying a Lambda function that needs to write logs to CloudWatch Logs. The function's execution role has the AWSLambdaBasicExecutionRole managed policy attached. However, logs are not being written. What is the MOST likely reason?

Accepted Answer

The Lambda function's execution role does not have sufficient permissions.. For a Lambda function to write logs to CloudWatch Logs, its execution role must have the necessary permissions: logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. If a custom execution role is used and these permissions are missing or insufficient, the Lambda function will fail to write logs. AWSLambdaBasicExecutionRole is an AWS-managed policy that contains these permissions, but a custom role must explicitly define them.

Answer

The Lambda function is using a customer-managed KMS key for log encryption.

Answer

The CloudWatch Logs agent is not installed on the Lambda execution environment.

Answer

The log group does not exist and the Lambda function cannot create it due to a resource-based policy.