DVA-C02 Security Practice Test 14 — 15 Questions

Question 1

A company has an S3 bucket with versioning enabled. A developer accidentally deleted an object. What must be done to recover it?

Accepted Answer

Delete the delete marker. When versioning is enabled on an S3 bucket, a delete operation does not actually remove the object; instead, it inserts a delete marker that becomes the current version, hiding the previous versions. To recover the object, you must delete that delete marker, which promotes the prior object version back to being the current version and makes it accessible again. Option C is therefore correct. Option A is wrong because no copy exists elsewhere, option B is wrong because Glacier Deep Archive is a storage class for archival data and is not involved in this recovery, and option D is wrong because versioning is already enabled and enabling it again would not restore the object.

Answer

Copy the object from another bucket

Answer

Restore the object from Glacier Deep Archive

Answer

Enable versioning on the bucket

Question 2

Which TWO are best practices for securing an AWS account? (Choose 2)

Accepted Answer

Enable multi-factor authentication (MFA) for privileged users. The best practices for securing an AWS account include enabling multi-factor authentication (MFA) for privileged users (Option D) and using IAM roles for applications that run on EC2 instances (Option E). Option A is incorrect because disabling CloudTrail reduces visibility into API activity, which is a security risk. Option B is incorrect because disabling password rotation weakens security posture. Option C is incorrect because the root user should be reserved for a limited set of tasks and not used daily.

Answer

Disable AWS CloudTrail to reduce costs

Answer

Disable password rotation to avoid user inconvenience

Answer

Use the root user for daily administrative tasks

Question 3

Which TWO actions are required to enable server-side encryption for an Amazon RDS instance? (Choose 2)

Accepted Answer

Use AWS KMS to manage the encryption key. Option D is correct because Amazon RDS encryption at rest is implemented using AWS Key Management Service (KMS) customer master keys (CMKs), so you must use AWS KMS to manage the encryption key that protects the DB instance's storage and snapshots. Option E is correct because RDS encryption at rest can only be enabled at the moment of DB instance creation (via the console, CLI --storage-encrypted, or API StorageEncrypted=true); you cannot turn it on afterward. Option A is wrong because an existing unencrypted RDS instance cannot simply have encryption enabled after creation—you must create a new encrypted instance from a snapshot. Option B is wrong because client-side encryption is an application-level concern and does not enable RDS server-side encryption at rest. Option C is wrong because placing the DB instance in a VPC is a networking configuration and has no bearing on enabling storage encryption.

Answer

Enable encryption on the database after creation

Answer

Use client-side encryption in the application

Answer

Configure the DB instance to use a VPC

Question 4

A developer attached the following IAM policy to an IAM user:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}
```

The user tries to download an object from example-bucket using the AWS CLI without specifying server-side encryption. What will happen?

Accepted Answer

The download fails with an AccessDenied error. The IAM policy allows s3:GetObject only if the request includes server-side encryption set to AES256. Since the user does not specify encryption, the condition is unmet, resulting in an AccessDenied error.

Answer

The download succeeds because the policy allows s3:GetObject

Answer

The download succeeds because the object is encrypted with SSE-S3

Answer

The download fails with a 500 Internal Server Error

Question 5

A developer runs the commands above. The key is disabled. An application that uses this key to encrypt S3 objects starts failing. What should the developer do to fix the issue?

Accepted Answer

Enable the KMS key. Enable the KMS key. The key is disabled, so enabling it will restore functionality. Option A (delete the key and recreate it) would create a new key, but the application would need to be updated to use the new key, which is unnecessary since the original key exists and can simply be re-enabled. Option B (create a new KMS key and update the application to use it) is also a valid but more complex fix; however, the simplest and most direct solution is to re-enable the key. Option D (enable automatic key rotation) does not affect the disabled state; it only sets a rotation policy for future key updates.

Answer

Delete the key and recreate it

Answer

Create a new KMS key and update the application to use it

Answer

Enable automatic key rotation

Question 6

A developer receives the above error when trying to launch an EC2 instance. What is the most likely cause?

Accepted Answer

An SCP at the organizational level denies ec2:RunInstances. The error message explicitly mentions a service control policy (SCP) that denies the action, indicating that an SCP at the organizational level is blocking the ec2:RunInstances action. Option C is therefore correct. Option A is incorrect because instance limit errors show a message about reaching the maximum number of instances, not an SCP denial. Option B is incorrect because VPC restrictions typically produce errors related to network constraints, not an explicit SCP reference. Option D is incorrect because an IAM policy denial would result in an 'UnauthorizedOperation' error, not one mentioning SCP.

Answer

The account has reached its EC2 instance limit

Answer

The developer is trying to launch the instance in a restricted VPC

Answer

The developer's IAM policy does not allow ec2:RunInstances

Question 7

A company wants to encrypt data at rest in Amazon S3. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the service that manages encryption keys for Amazon S3's server-side encryption with KMS (SSE-KMS). Option A is wrong because AWS Certificate Manager (ACM) handles SSL/TLS certificates, not encryption keys for S3. Option B is wrong because AWS CloudHSM provides hardware-based key management but is not directly integrated with S3 for SSE; KMS is the managed service for this use case. Option C is wrong because AWS Identity and Access Management (IAM) controls access permissions, not encryption key management.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Question 8

A developer is tasked with rotating database credentials stored in AWS Secrets Manager for an RDS MySQL instance. The rotation must occur automatically every 30 days. What is the BEST approach?

Accepted Answer

Configure automatic rotation in Secrets Manager using a rotation Lambda function.. Secrets Manager natively supports automatic rotation via a Lambda rotation function, and for RDS MySQL it provides a built-in rotation template that handles the two-step process of creating a new password and updating both the database and the secret. Configuring rotation with a 30-day schedule is a single setting in the console or CLI. This is the purpose-built, lowest-effort solution.

Answer

Store the credentials in AWS Systems Manager Parameter Store and use a scheduled Lambda to rotate them.

Answer

Use RDS automatic password rotation and have the application fetch the new password from RDS.

Answer

Use an IAM role for the RDS instance and rotate the role's credentials.

Question 9

A developer is creating a new IAM policy to allow an application to read objects from a specific S3 bucket and write logs to a CloudWatch log group. Which policy statement is correct?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","logs:CreateLogStream","logs:PutLogEvents"],"Resource":["arn:aws:s3:::my-bucket/*","arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup:*"]}. It grants the necessary permissions: s3:GetObject to read objects from the bucket, and logs:CreateLogStream and logs:PutLogEvents to write logs to the CloudWatch log group. The resources are correctly specified: the bucket ARN with a wildcard for objects, and the log group ARN with a wildcard for log streams. Option A is incorrect because it uses ec2:DescribeInstances, which is unrelated to S3 or CloudWatch. Option B is incorrect because it only allows s3:ListBucket on the bucket (listing objects) but not reading them (s3:GetObject), and it does not include CloudWatch actions. Option D is incorrect because it only allows s3:PutObject (writing objects) rather than reading, and lacks CloudWatch permissions.

Answer

{"Effect":"Allow","Action":["ec2:DescribeInstances"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:ListBucket"],"Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":["s3:PutObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 10

A developer needs to securely pass a secret API key to an AWS Lambda function. What is the MOST secure and recommended approach?

Accepted Answer

Store the API key in AWS Secrets Manager and retrieve it in the Lambda function code.. AWS Secrets Manager is a dedicated service for securely storing and managing secrets like API keys. It integrates natively with Lambda, allowing retrieval at runtime with minimal permissions using IAM roles. Option A (DynamoDB) is less secure because it requires managing encryption and access policies manually, and the secret might be exposed in query logs. Option B (hardcoding) is insecure as the key is visible in source code and version control. Option C (environment variables) can be viewed in the Lambda console and CloudWatch Logs, and they are not encrypted by default unless using encryption helpers. Therefore, Secrets Manager (Option D) is the most secure and recommended approach.

Answer

Store the API key in an Amazon DynamoDB table and query it from the Lambda function.

Answer

Hardcode the API key in the Lambda function code.

Answer

Store the API key in an environment variable of the Lambda function.

Question 11

A company is using AWS CodeCommit for source control. Developers need to access the repository from their local machines. Which authentication method is recommended for secure access?

Accepted Answer

Generate and use SSH keys paired with an IAM user.. SSH keys provide secure access without storing credentials on the machine and can be paired with an IAM user for CodeCommit. Option A is wrong because IAM user password is for console access, not Git. Option B is wrong because while access keys can be used for Git credentials, they are long-term credentials and less secure than SSH keys. Option C is wrong because Cognito is for end-user authentication, not developer access to CodeCommit.

Answer

Use IAM user name and password for Git credentials.

Answer

Use IAM access key and secret key for authentication.

Answer

Use Amazon Cognito user pools for authentication.

Question 12

A developer notices that an IAM user has permissions to terminate EC2 instances, but the user should only be allowed to stop instances. The developer needs to update the policy to prevent termination while allowing stop. Which IAM policy statement should be added?

Accepted Answer

{"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"}. An explicit Deny statement always overrides any Allow in IAM policy evaluation, so adding {"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"} guarantees the user cannot terminate instances even if an existing policy grants it. This is the only option that removes the unwanted permission while leaving ec2:StopInstances untouched.

Answer

{"Effect":"Allow","Action":"ec2:TerminateInstances","Resource":"*"}

Answer

{"Effect":"Allow","Action":["ec2:StopInstances","ec2:TerminateInstances"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"ec2:RebootInstances","Resource":"*"}

Question 13

A developer wants to encrypt data in transit between an application and an S3 bucket. Which option achieves this?

Accepted Answer

Use HTTPS when making requests to S3.. HTTPS encrypts data in transit between the application and S3, ensuring confidentiality during transmission. Option A is incorrect because SSE-S3 encrypts data at rest, not in transit. Option B is incorrect because IAM policies control access permissions, not encryption. Option D is incorrect because encrypting data with AWS KMS before upload addresses at-rest encryption, but without HTTPS, data is still transmitted in plaintext.

Answer

Enable server-side encryption with S3 managed keys (SSE-S3).

Answer

Configure an IAM policy to require encryption.

Answer

Use AWS KMS to encrypt the data before upload.

Question 14

A company has an S3 bucket with a policy that denies access to all users. The bucket owner wants to grant read access to a specific IAM user. What must be done?

Accepted Answer

Remove the Deny statement from the bucket policy.. In S3 bucket policies, an explicit Deny always overrides any Allow. Since the bucket policy currently denies access to all users, simply adding an Allow statement for the specific IAM user will not work—the Deny will still take precedence. Therefore, the Deny statement must be removed or modified to exclude that user before an Allow can be effective. Option C is correct because it addresses the root cause: the explicit Deny must be eliminated to permit any access.

Answer

Create a new bucket and copy objects there.

Answer

Add an Allow statement in the bucket policy for the user.

Answer

Add the user to the bucket ACL with read permission.

Question 15

Which TWO of the following are best practices for securing AWS account root user?

Accepted Answer

Delete the root user access keys.. Option A is correct because AWS best practice is to remove (delete) any access keys associated with the root user, since long-term programmatic credentials on the root account pose a severe risk if leaked and root should not be used for API/CLI access. Option E is correct because enabling MFA on the root user adds a critical second authentication factor, protecting the account from password compromise and required for sensitive root-only operations. Options B, C, and D are not best practices: the root user should not be used for daily administrative tasks (use IAM users/roles instead), AWS does not provide an account-level password policy that locks the root user after failed attempts, and sharing the root password with developers violates least privilege and accountability.

Answer

Use the root user for daily administrative tasks.

Answer

Set a password policy that locks the root user after 10 failed attempts.

Answer

Share the root user password with senior developers for emergencies.