DVA-C02 Security Practice Test 14 — 15 Questions

Question 1

A developer is building a web application that uses Amazon Cognito for user authentication. Which TWO actions should be taken to secure the application?

Accepted Answer

Enable multi-factor authentication (MFA) for users.. Enabling multi-factor authentication (MFA) adds an extra layer of security beyond just a password, requiring users to provide a second factor (e.g., a one-time code from an authenticator app or SMS). This significantly reduces the risk of unauthorized access due to compromised credentials. Amazon Cognito supports MFA natively, allowing developers to enforce it for user pools.

Answer

Disable token expiration to avoid frequent re-authentication.

Answer

Use IAM users for authentication instead of Cognito.

Answer

Store user tokens in local storage for persistence.

Question 2

A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which THREE steps should be taken?

Accepted Answer

Add a condition in the key policy that allows decrypt only when the principal matches the desired IAM roles.. Key policies in AWS KMS are resource-based policies that directly control access to the CMK. By adding a condition that restricts the `kms:Decrypt` action to only specific IAM roles (using the `aws:PrincipalArn` or `kms:CallerPrincipal` condition key), the security team can ensure that only those roles can decrypt data encrypted with that key. This approach is more secure than relying solely on IAM policies, as key policies are evaluated first and can explicitly deny access even if an IAM policy grants it.

Answer

Grant all IAM users decrypt permission and rely on S3 bucket policies.

Answer

Use separate CMKs for each IAM role to isolate access.

Question 3

A developer needs to securely transfer files from an on-premises server to an S3 bucket. Which TWO methods meet the security requirements?

Accepted Answer

Use AWS Transfer Family with SFTP protocol.. AWS Transfer Family provides a fully managed service that supports SFTP (SSH File Transfer Protocol) for securely transferring files to Amazon S3. It uses SSH for authentication and encryption, ensuring data in transit is protected without requiring any changes to the on-premises server's existing SFTP infrastructure.

Answer

Use the S3 sync command without any additional configuration.

Answer

Generate a presigned URL and use it with wget.

Answer

Use FTP with TLS.

Question 4

Refer to the exhibit. A developer has attached this resource-based policy to an S3 bucket. The Lambda function 'my-function' is still getting access denied when trying to read objects from the bucket. What is the MOST likely reason?

Accepted Answer

The condition aws:SourceArn does not match the principal's ARN because the principal is the Lambda execution role, not the function.. When a Lambda function executes and makes calls to other AWS services like S3, it assumes its IAM execution role. The principal making the request is the IAM role itself, not the Lambda function resource. Therefore, the `aws:PrincipalArn` global condition key evaluates to the ARN of the IAM execution role (e.g., `arn:aws:iam::123456789012:role/my-execution-role`). Since the policy expects the Lambda function's ARN (`arn:aws:lambda:...`), the condition fails and access is denied. To fix this, the condition should check for the execution role's ARN.

Answer

The bucket name is incorrect in the policy.

Answer

The Lambda function's execution role does not have s3:GetObject permission.

Answer

The policy denies s3:GetObject for the Lambda function.

Question 5

A developer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket even though the instance has an IAM role with full S3 access. The instance can access the internet. What is the most likely cause?

Accepted Answer

The instance is in a private subnet without a NAT gateway or VPC endpoint for S3.. To resolve the contradiction, the stem should state that the instance is in a private subnet and cannot access the internet. This makes Option A the correct and logical choice, as a private subnet without a NAT gateway or a VPC endpoint has no path to reach S3.

Answer

S3 Transfer Acceleration is not enabled on the bucket.

Answer

The security group attached to the instance blocks outbound traffic to S3.

Answer

The IAM role is not correctly associated with the instance.

Question 6

A company has a requirement to automatically rotate database credentials every 30 days. Which AWS service can meet this requirement with minimal development effort?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it provides built-in, automated rotation of database credentials without custom code. You can define a rotation schedule (e.g., every 30 days) and Secrets Manager will automatically update the secret and the database password using a Lambda function, meeting the requirement with minimal development effort.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS Systems Manager Parameter Store

Question 7

Which TWO actions are valid ways to encrypt data at rest in Amazon S3? (Choose TWO.)

Accepted Answer

Use S3-managed keys (SSE-S3). SSE-S3 is a valid server-side encryption option where Amazon S3 manages the encryption keys on your behalf. When you upload an object, S3 encrypts the data using AES-256 before writing it to disk and decrypts it when you access it, all without requiring any additional configuration or key management from you.

Answer

Use client-side encryption with a KMS key

Answer

Use SSL/TLS for all data transfers

Answer

Use AWS CloudHSM to store encryption keys

Question 8

Which TWO security best practices should be applied when using AWS Lambda? (Choose TWO.)

Accepted Answer

Attach an IAM execution role with least privilege permissions.. AWS Lambda requires an IAM execution role that defines the permissions the function has when interacting with other AWS services. The principle of least privilege dictates that this role should grant only the specific actions and resources needed for the function's intended purpose, minimizing the potential blast radius if the function is compromised. Additionally, sensitive data such as database credentials should never be hardcoded or stored in plaintext environment variables; instead, they should be stored securely in AWS Secrets Manager (or Systems Manager Parameter Store) and retrieved dynamically at runtime.

Answer

Enable CloudWatch Logs for the Lambda function.

Answer

Hardcode database credentials in the function code.

Answer

Store sensitive data in Lambda environment variables.

Question 9

An IAM user has the above IAM policy attached. What is the effect?

Accepted Answer

The user can read objects from example-bucket.. The IAM policy grants `s3:GetObject` permission on `arn:aws:s3:::example-bucket/*`, which allows reading objects from the bucket. Since there is no explicit deny and the policy only allows this single action, the user can read objects but cannot perform other actions like listing or deleting. Option D is correct because the policy explicitly permits read access to objects.

Answer

The user is denied access to example-bucket.

Answer

The user can list the objects in example-bucket.

Answer

The user can perform all S3 actions on example-bucket.

Question 10

A developer created the following IAM role for a Lambda function:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {"Service": "lambda.amazonaws.com"},
      "Action": "sts:AssumeRole"
    }
  ]
}
```

The function needs to write logs to CloudWatch Logs. What is missing?

Accepted Answer

The role needs a permissions policy that grants logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents.. The role shown includes a trust policy that allows Lambda to assume the role but does not include an attached permissions policy for CloudWatch Logs. To write logs to CloudWatch Logs, the Lambda function must be granted logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents through a permissions policy attached to the role.

Answer

The trust policy is incorrect; it should allow ec2.amazonaws.com.

Answer

The role name is invalid.

Answer

The trust policy should not allow Lambda to assume the role.

Question 11

A developer applied the above bucket policy to an S3 bucket. What is the outcome?

Accepted Answer

All requests to the bucket must use HTTPS; otherwise, they are denied.. The bucket policy includes a `Deny` effect with a `StringNotEquals` condition on `aws:SecureTransport`, which denies any request that does not use HTTPS. Since the `Principal` is set to `*`, this applies to all users, including anonymous users. Therefore, any request made over HTTP is denied, effectively requiring HTTPS for all access.

Answer

Anonymous users are allowed to read objects.

Answer

Only write requests are denied if not using HTTPS.

Answer

The policy has no effect because it uses Deny.

Question 12

An application uses IAM roles to grant EC2 instances access to S3. The developer notices that the application works correctly in one account but fails with access denied in another account. What is the most likely cause?

Accepted Answer

The S3 bucket policy does not grant access to the IAM role. When an S3 bucket is encrypted with a Customer Managed Key (SSE-KMS), the IAM role accessing the bucket must have permissions to use the KMS key (specifically `kms:Decrypt` and/or `kms:GenerateDataKey`). Additionally, the KMS key policy must explicitly grant these permissions to the IAM role. If the production bucket uses a customer-managed KMS key while the development bucket uses default SSE-S3 encryption, the application will fail with an 'Access Denied' error in production despite having identical S3 and IAM policies.

Answer

The IAM role is not attached to the EC2 instance

Answer

The EC2 instance does not have internet access

Answer

The KMS key policy does not allow decryption

Question 13

A company uses AWS CodePipeline with a cross-account action that deploys to an S3 bucket in another account. The deployment fails with 'Access Denied'. The pipeline role has permissions to assume a role in the target account, and the target role has S3 putObject permissions. What additional configuration is required?

Accepted Answer

Add a trust policy on the target IAM role to allow the pipeline role to assume it. For cross-account role assumption to work, a trust relationship must be established on both sides. The pipeline role in the source account must have identity-based permissions to perform `sts:AssumeRole` on the target role (which the stem states is already configured). Additionally, the target IAM role in the destination account must have a trust policy (resource-based policy) that explicitly allows the pipeline role (or the source AWS account) to assume it. Without this trust policy, the `AssumeRole` operation will fail with an 'Access Denied' error.

Answer

Add a bucket policy on the S3 bucket to allow the assumed role to put objects

Answer

Enable versioning on the S3 bucket

Answer

Enable KMS encryption on the S3 bucket and grant decrypt permissions

Question 14

A developer wants to securely transmit secrets to an EC2 instance at launch. Which approach is recommended?

Accepted Answer

Use EC2 Instance Metadata Service (IMDSv2) to retrieve secrets from AWS Secrets Manager. The recommended and secure approach is to attach an IAM role to the EC2 instance. The application running on the instance can then use the AWS SDK (which automatically retrieves temporary credentials via the Instance Metadata Service) to securely fetch the secrets directly from AWS Secrets Manager at runtime. This prevents secrets from being exposed in plaintext in user data, AMIs, or source code.

Answer

Store secrets in environment variables within an AMI

Answer

Hardcode secrets in the application code

Answer

Pass secrets in user data as plain text

Question 15

A developer is building a serverless application using an API Gateway HTTP API and Lambda. The developer needs to authenticate users with a JWT token. Which API Gateway feature should be used?

Accepted Answer

JWT Authorizer. API Gateway HTTP APIs support JWT Authorizers natively. This feature allows API Gateway to validate JSON Web Tokens (JWTs) directly without invoking a Lambda function, verifying the token's signature, expiry, and issuer against a configured identity provider (such as Amazon Cognito or any OIDC-compliant provider). This is the most efficient and cost-effective way to handle JWT authentication in HTTP APIs.

Answer

Lambda Authorizer

Answer

IAM Authorizer

Answer

Amazon Cognito User Pools