DVA-C02 Security Practice Test 14 — 15 Questions

Question 1

A company is designing a secure CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The pipeline must securely store and access sensitive parameters (e.g., API keys) used during the build. Which TWO services can be used to securely store and retrieve these parameters?

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). AWS Systems Manager Parameter Store (SecureString) and AWS Secrets Manager are both designed to securely store secrets and can be accessed by CodeBuild via IAM roles.

Answer

Amazon S3 with server-side encryption

Answer

AWS Key Management Service (KMS) alone

Answer

AWS CloudFormation parameter store

Question 2

A developer is creating an IAM policy to allow access to an Amazon DynamoDB table. The policy must allow the user to read and write items, but not to delete the table or modify its schema. Which TWO DynamoDB actions should be included in the policy?

Accepted Answer

GetItem. GetItem and PutItem are the actions for reading and writing individual items. DeleteTable and UpdateTable are administrative actions that should not be allowed.

Answer

UpdateTable

Answer

Scan

Answer

DeleteTable

Question 3

A developer needs to encrypt data at rest in an Amazon S3 bucket. Which THREE options are available for server-side encryption?

Accepted Answer

SSE-C. S3 offers three server-side encryption options: SSE-S3 (using S3-managed keys), SSE-KMS (using AWS KMS), and SSE-C (using customer-provided keys).

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 4

A developer attached the IAM policy above to an IAM user. What is the effect when the user tries to download an object from the 'confidential' folder in 'example-bucket'?

Accepted Answer

The user is denied access because of the explicit Deny statement. The policy has an explicit Deny for all s3 actions on the confidential folder. Explicit Deny overrides any Allow. Therefore, the user will be denied access even though the first statement allows GetObject on all objects.

Answer

The policy is invalid because Deny cannot be used with s3:*

Answer

The user can download only if the object is encrypted

Answer

The user can download the object because of the Allow statement

Question 5

A developer attached the managed policy above to an IAM role used by an application. The application tries to decrypt data using a KMS key that has an encryption context of {"department": "finance"}. However, the request fails with access denied. What is the most likely reason?

Accepted Answer

The KMS key policy does not grant decrypt permission to the IAM role. The policy uses a condition key kms:EncryptionContext:department, which requires the encryption context to match exactly. However, the context is a key-value pair; the condition must match both the key and the value. The policy might be correct, but the issue could be that the application does not pass the encryption context, or the KMS key policy does not grant access. The most likely reason is that the KMS key policy itself does not allow the IAM role to decrypt, because KMS requires both key policy and IAM policy to allow access.

Answer

The IAM role does not have permission to call kms:Decrypt on any key

Answer

The encryption context does not match the condition

Answer

The IAM policy does not allow the kms:Decrypt action

Question 6

The above resource-based policy is attached to an SQS queue. An application running on an EC2 instance with the IAM role 'AppRole' tries to send a message to the queue but receives an access denied error. What is the most likely cause?

Accepted Answer

The IAM role does not have an identity-based policy allowing sqs:SendMessage. The resource-based policy allows the role to send messages, but the role itself must also have an IAM policy that allows sqs:SendMessage. Without that, the request is denied because both the identity-based policy and the resource-based policy must grant access (unless one is an explicit deny).

Answer

The SQS queue is encrypted with a KMS key that the role cannot use

Answer

The principal ARN in the policy is incorrect

Answer

The SQS queue policy does not include the correct region

Question 7

A company is using AWS Secrets Manager to rotate database credentials automatically. The rotation Lambda function fails with a timeout error after 30 seconds. The developer checked the Lambda logs and saw that the function is making network calls to the database but never receives a response. What is the MOST likely cause?

Accepted Answer

The Lambda function is not attached to a VPC with a NAT gateway or VPC endpoints for Secrets Manager.. Option A is correct because Lambda functions in a VPC require a NAT gateway or VPC interface endpoints to access the internet or AWS services outside the VPC. The database is likely in a private subnet without internet access, and the Secrets Manager endpoint might be unreachable, causing the timeout. Options B, C, and D are incorrect because increasing timeout or memory would not solve network connectivity issues, and disabling rotation would not address the root cause.

Answer

The Lambda function memory is insufficient; increase memory to 1024 MB.

Answer

The Lambda function timeout is set too low; increase it to 5 minutes.

Answer

The database credentials are incorrect; the rotation function cannot authenticate.

Question 8

A developer wants to grant an IAM user permissions to list all S3 buckets in the account, but deny access to a specific bucket named 'confidential-data'. Which IAM policy should be attached?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:ListBucket","Resource":"arn:aws:s3:::confidential-data"}]}. Option C is correct because the policy grants s3:ListAllMyBuckets and explicitly denies s3:ListBucket on the confidential-data bucket. The explicit deny overrides the allow. Option A denies all ListBucket actions, preventing listing any bucket. Option B grants access to all buckets. Option D is invalid syntax.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:ListBucket","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:ListBucket","Resource":"confidential-data"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::confidential-data"}]}

Question 9

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated automatically every year. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Use an AWS managed key (aws/s3) for S3 encryption.. Option B is correct because AWS managed keys (aws/s3) are automatically rotated annually with no effort. Option A requires manual rotation. Option C is for customer managed keys and requires enabling automatic rotation. Option D is for asymmetric keys, which are not used for S3 encryption.

Answer

Use a customer managed key and enable automatic rotation.

Answer

Create a customer managed key and rotate it manually every year.

Answer

Use an asymmetric KMS key and rotate it automatically.

Question 10

A developer is deploying a web application on EC2 instances behind an Application Load Balancer. The application needs to authenticate users via a third-party identity provider (IdP) that supports OpenID Connect (OIDC). The developer wants to offload authentication to the ALB. Which configuration is required?

Accepted Answer

Register the third-party IdP as an OIDC identity provider in IAM, then configure the ALB listener rule to authenticate users using that provider.. Option C is correct because ALB can authenticate users via OIDC by configuring a rule that uses an OIDC IdP. The developer must register the IdP in IAM as an OIDC identity provider, then configure the ALB listener rule to use that provider. Option A is incorrect because Cognito is not required if the IdP supports OIDC directly. Option B is incorrect because the ALB handles authentication, not the EC2 instances. Option D is incorrect because IAM roles are for AWS services, not user authentication.

Answer

Install and configure an OIDC client on the EC2 instances.

Answer

Configure Amazon Cognito as an identity provider and integrate with the ALB.

Answer

Create an IAM role for the EC2 instances that allows them to assume the identity of the user.

Question 11

A company wants to store sensitive data in S3. The data must be encrypted at rest using server-side encryption with a key that is automatically rotated annually. Which S3 encryption option should be used?

Accepted Answer

SSE-S3. Option A is correct because SSE-S3 uses AWS managed keys that are automatically rotated. Option B (SSE-KMS) requires managing key rotation. Option C (SSE-C) does not manage rotation. Option D (client-side) is not server-side.

Answer

Client-side encryption

Answer

SSE-KMS with a customer managed key

Answer

SSE-C

Question 12

A developer is building a serverless application using API Gateway and Lambda. The API must be accessible only from a specific VPC. How can the developer achieve this?

Accepted Answer

Create a VPC endpoint for API Gateway and attach a resource policy to the API that allows access only from the VPC endpoint.. Option B is correct because resource policies on API Gateway can restrict access to a VPC or VPC endpoint. Option A is incorrect because API Gateway is a regional service and cannot be placed inside a VPC. Option C is incorrect because security groups are for EC2, not API Gateway. Option D is incorrect because CloudFront does not restrict access to a specific VPC.

Answer

Use security groups to restrict access to the API Gateway.

Answer

Create the API Gateway inside the VPC.

Answer

Use CloudFront with an origin access identity to restrict access.

Question 13

A company uses IAM roles to grant permissions to EC2 instances. The security team notices that an instance is using a role that has administrator privileges, which is a security risk. What is the BEST way to restrict the instance's permissions without disrupting the application?

Accepted Answer

Create a new IAM role with only required permissions, attach it to the instance profile, and update the instance to use the new profile.. Option C is correct because creating a new role with only necessary permissions and updating the instance profile allows the application to continue with minimal disruption. Option A would cause downtime. Option B affects all instances using that role. Option D is not sufficient because the application might still use the previous role until restarted.

Answer

Remove the existing role from the instance and let the application fail.

Answer

Modify the trust policy of the existing role to deny access to the instance.

Answer

Attach a permissions boundary to the existing role that limits the maximum permissions.

Question 14

A developer needs to grant an IAM user the ability to create and manage CloudFormation stacks. Which IAM policy action should be allowed?

Accepted Answer

cloudformation:CreateStack. Option B is correct because cloudformation:CreateStack is the action to create stacks. Option A is for EC2, Option C is for S3, Option D is for Lambda.

Answer

lambda:CreateFunction

Answer

ec2:RunInstances

Answer

s3:CreateBucket

Question 15

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all S3 buckets across all accounts are encrypted with SSE-S3. What is the MOST effective way to enforce this?

Accepted Answer

Use an SCP in AWS Organizations to deny s3:PutBucketEncryption unless the encryption algorithm is AES256.. Option D is correct because service control policies (SCPs) can be applied at the organization level to deny actions that do not meet conditions. An SCP can deny s3:PutBucketEncryption if the encryption is not SSE-S3. Option A is not possible because you cannot directly apply IAM policies to all accounts. Option B is per account and not centralized. Option C is per bucket and not enforced across accounts.

Answer

Create an IAM policy that denies non-SSE-S3 encryption and attach it to all users.

Answer

Use AWS Config rules to detect buckets without SSE-S3 and send alerts.

Answer

Use S3 bucket policies to deny PutObject if encryption is not SSE-S3.