DVA-C02 Security Practice Test 13 — 15 Questions

Question 1

A developer needs to call AWS APIs from application code running on EC2. Which credential source should the AWS SDK use by default?

Accepted Answer

Temporary credentials from the instance profile role. The AWS SDK on EC2 automatically retrieves temporary credentials from the instance metadata service (IMDS) at http://169.254.169.254/latest/meta-data/iam/security-credentials/. These credentials are provided by the IAM role attached to the EC2 instance (the instance profile role) and are rotated automatically, eliminating the need to store long-term credentials on the instance.

Answer

Static credentials committed to Git

Answer

A credentials file copied into the AMI

Answer

The root account access key

Question 2

An S3 bucket policy allows GetObject from another account, but objects encrypted with SSE-KMS still return AccessDenied. Which additional authorization is required?

Accepted Answer

The caller must be allowed to use the KMS key for decrypt operations. When an S3 object is encrypted with SSE-KMS, the S3 bucket policy granting GetObject access is not sufficient because S3 must also decrypt the object before returning it. The AWS KMS key policy must grant the caller kms:Decrypt permission, and the caller's IAM policy must also allow kms:Decrypt on the specific KMS key. Without this additional KMS authorization, S3 returns AccessDenied even if the bucket policy allows GetObject.

Answer

The caller must own the destination VPC

Answer

The bucket must enable static website hosting

Answer

The object key must end with .kms

Question 3

A developer needs to prevent accidental public access to all S3 buckets in an account. Which account-level control should be enabled?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is an account-level control that provides a centralized way to enforce that no S3 buckets or objects in the account can be made publicly accessible, regardless of individual bucket policies or ACLs. This setting overrides any bucket-level public access settings, effectively preventing accidental exposure of data to the internet.

Answer

S3 Transfer Acceleration

Answer

S3 Inventory

Answer

S3 Object Lambda

Question 4

A Lambda function in a VPC must retrieve secrets from Secrets Manager without traversing the public internet. Which configuration should be used?

Accepted Answer

An interface VPC endpoint for Secrets Manager with appropriate security groups. An interface VPC endpoint (AWS PrivateLink) for Secrets Manager allows Lambda functions within a VPC to securely retrieve secrets using private IP addresses, without traversing the public internet. This is achieved by creating an elastic network interface in the VPC subnet with a security group that controls access, ensuring traffic stays within the AWS network.

Answer

A public NAT gateway only

Answer

An internet gateway attached to the Lambda subnet

Answer

A VPC peering connection to every AWS region

Question 5

An application in ECS Fargate needs to read a secret and decrypt it with KMS. Which two permissions/configurations are needed?

Accepted Answer

Task role permissions for Secrets Manager access. The ECS task role is an IAM role that the Fargate task assumes to make AWS API calls. To read a secret from AWS Secrets Manager, the task role must have an IAM policy granting `secretsmanager:GetSecretValue` permission. Option D is correct because the secret is encrypted with a KMS key, so the task role also needs a KMS key policy or IAM permission that allows `kms:Decrypt` on that specific key.

Answer

Store the secret in the container image

Answer

An EC2 instance profile attached to the Fargate host

Question 6

A developer needs to securely distribute temporary AWS credentials to authenticated mobile users. Which two components are commonly involved?

Accepted Answer

Amazon Cognito identity pools. Amazon Cognito identity pools allow you to exchange identity tokens (from a user pool or external IdP) for temporary AWS credentials via the AWS Security Token Service (STS). These credentials are scoped to an IAM role with fine-grained permissions, enabling secure, least-privilege access to AWS resources from mobile apps without embedding long-term keys.

Answer

AWS root access keys

Answer

An unrestricted S3 bucket policy

Question 7

Drag and drop the steps to implement a disaster recovery plan using cross-region replication for S3 in the correct order.

Accepted Answer

Create source and destination S3 buckets, then enable versioning on both buckets, then set up IAM permissions for replication, then configure a replication rule on the source bucket.. First create buckets, enable versioning, configure replication rule, and set permissions.

Answer

Enable versioning on both buckets, then create source and destination S3 buckets, then set up IAM permissions, then configure a replication rule.

Answer

Configure a replication rule on the source bucket, then create source and destination S3 buckets, then enable versioning, then set up IAM permissions.

Answer

Create source and destination S3 buckets, then set up IAM permissions, then configure a replication rule, then enable versioning on both buckets.

Question 8

Drag and drop the steps to set up a DynamoDB table with auto scaling in the correct order.

Accepted Answer

Create DynamoDB table, then Create scaling target, then Define scaling policies, then Apply scaling policies. The correct order for setting up DynamoDB auto scaling is: first create the DynamoDB table with provisioned capacity, then create an Application Auto Scaling target for the table, then define the scaling policies (for read and write capacity), and finally apply the policies to the target. The target must be registered before policies can be defined.

Answer

Create DynamoDB table, then Define scaling policies for read and write, then Create scaling target, then Apply scaling policies

Answer

Define scaling policies, then Create scaling target, then Create DynamoDB table, then Apply scaling policies

Answer

Create DynamoDB table, then Create scaling target, then Apply scaling policies, then Define scaling policies

Question 9

Match each AWS tool or feature to its description.

Accepted Answer

AWS CodeDeploy: Automates code deployments to any instance. AWS CodeDeploy automates code deployments, while Amazon CloudWatch provides monitoring. The distractors swap these definitions to test understanding of each service's purpose.

Answer

AWS CodeDeploy: Monitors AWS resources and applications

Answer

Amazon CloudWatch: Automates code deployments to any instance

Question 10

A developer needs to allow an EC2 instance to read items from a DynamoDB table. Which is the best practice for granting permissions?

Accepted Answer

Attach an IAM role with the required permissions to the EC2 instance. Attaching an IAM role to the EC2 instance is the AWS best practice because it provides temporary, automatically rotated credentials via the instance metadata service (IMDS), eliminating the need to embed long-lived access keys. The role's policy grants only the required DynamoDB read permissions, following least privilege. This is the standard, secure, and auditable approach for EC2-to-AWS-service authentication.

Answer

Store IAM user access keys on the instance

Answer

Use root user credentials

Answer

Apply a service control policy (SCP) to the instance

Question 11

A company uses AWS KMS with customer managed keys to encrypt S3 objects. The security team requires automatic key rotation. What must the developer do to enable rotation?

Accepted Answer

Enable automatic key rotation in the KMS key settings. Customer managed KMS keys support optional automatic key rotation, which must be explicitly enabled in the key's settings. Once enabled, AWS rotates the backing key material every 365 days (or a custom period of 90–2560 days) while preserving the same key ID, ARN, and alias, so existing ciphertext remains decryptable. Enabling rotation in the KMS key settings is therefore the correct action.

Answer

Use AWS managed keys instead of customer managed keys

Answer

Rotation is enabled by default for all KMS keys

Answer

Create a new key and update the alias to point to the new key annually

Question 12

An application running on EC2 needs to access an S3 bucket. What is the most secure way to grant access?

Accepted Answer

Create an IAM role with S3 permissions and attach it to the EC2 instance. Attaching an IAM role to the EC2 instance (D) is the most secure approach because it delivers temporary, automatically rotated credentials to the instance via the Instance Metadata Service (IMDS), eliminating long-lived access keys stored on disk. The role's trust policy allows EC2 to assume it, and the attached permissions policy scopes exactly which S3 actions and resources the instance can access. This follows AWS least-privilege and credential-hygiene best practices.

Answer

Generate an IAM user access key and store it in a file on the instance

Answer

Use pre-signed URLs for each request

Answer

Make the S3 bucket public

Question 13

A company wants to audit all API calls made to AWS. Which service should be used to collect and store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls and can store logs in S3. Option A (VPC Flow Logs) captures network traffic, not API calls. Option B (AWS Config) records resource configuration changes, not API calls. Option D (Amazon CloudWatch Logs) can store logs but is not the primary service for API auditing.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 14

A developer receives an AccessDenied error when trying to upload a file to an S3 bucket that has a bucket policy requiring encryption in transit. What is the most likely cause?

Accepted Answer

The request is not using HTTPS. A bucket policy that requires encryption in transit typically uses a condition like aws:SecureTransport: true, which evaluates to false for HTTP requests. If the SDK or client sends the PutObject request over HTTP instead of HTTPS, the condition fails and S3 returns AccessDenied. The most likely cause is that the request is not using HTTPS.

Answer

The object is not encrypted with server-side encryption

Answer

The IAM user does not have s3:PutObject permission

Answer

The request signature is expired

Question 15

A developer needs to securely store database credentials for a serverless application. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets such as database credentials, with native integration to RDS rotation Lambdas and fine-grained IAM access. It encrypts secrets with KMS and supports automatic rotation, which is the key differentiator for credential storage.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3

Answer

AWS Key Management Service (KMS)