DVA-C02 Security Practice Test 15 — 15 Questions

Question 1

A company is using AWS CodeBuild to build a Docker image and push it to Amazon ECR. Which permissions are required for the CodeBuild service role? (Choose THREE.)

Accepted Answer

ecr:PutImage. `ecr:PutImage` is the permission required to push a Docker image to an Amazon ECR repository. When CodeBuild completes a build and runs `docker push`, it calls the ECR API `PutImage` to upload the image manifest. Without this permission, the push operation will fail with an access denied error.

Answer

ecr:CreateImage

Answer

ecr:BatchGetImage

Question 2

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated every 90 days. Which key type should the company use to meet this requirement with minimal operational overhead?

Accepted Answer

Customer managed KMS key with automatic rotation enabled. Customer managed KMS keys support automatic rotation with a configurable rotation period. You can set the rotation period to 90, 180, or 365 days when enabling automatic rotation. This allows the company to meet the 90-day rotation requirement with minimal operational overhead, as AWS handles the rotation automatically. AWS managed keys and AWS owned keys do not allow custom rotation periods, and manual rotation (option A) requires significant overhead.

Answer

Customer managed KMS key with manual rotation

Answer

AWS managed KMS key

Answer

AWS owned KMS key

Question 3

Refer to the exhibit. A developer applies this IAM policy to an IAM user. What is the effective result when the user attempts to download an object from the 'confidential' folder in the 'my-company-data' bucket?

Accepted Answer

The user cannot download objects from the confidential folder due to the explicit Deny.. Without the IAM policy exhibit, it is impossible to verify if the policy is syntactically valid, if the Deny block is correctly structured, or if there are any other conflicting statements. Additionally, the explanation mentions 'using a condition with StringLike on the ARN', which is highly unusual for S3 path restrictions (which typically use the Resource element or s3:prefix condition keys), suggesting the underlying policy might contain technical inaccuracies.

Answer

The user can download objects from the confidential folder but cannot upload to it.

Answer

The user cannot download objects from any folder because the policy is invalid.

Answer

The user can download objects from the confidential folder because the Allow statement grants access.

Question 4

A developer is troubleshooting an issue where an IAM role assumed by an EC2 instance does not have permission to call the DynamoDB PutItem API. The role has a policy that allows all DynamoDB actions on a specific table. Which of the following is the most likely cause?

Accepted Answer

The IAM role policy does not include the 'dynamodb:PutItem' action or the resource ARN is incorrect.. An AccessDenied exception indicates an authorization failure. For the EC2 instance to successfully call `PutItem` on the DynamoDB table, the attached IAM role must have a policy that explicitly allows the `dynamodb:PutItem` action on the specific table's Amazon Resource Name (ARN). If the action is missing or the ARN is incorrect/mismatched, IAM will deny the request. Network issues (Option D) would result in connection timeouts, and region mismatches (Option B) typically result in ResourceNotFound exceptions, not AccessDenied.

Answer

The IAM role has not been attached to the EC2 instance profile.

Answer

The DynamoDB table is not in the same region as the EC2 instance.

Answer

The EC2 instance does not have the necessary network connectivity to DynamoDB.

Question 5

Refer to the exhibit. A developer runs the AWS CLI command to decrypt a file using a KMS key alias 'my-key' and receives the error shown. The developer has an IAM policy that allows 'kms:Decrypt' on 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...'. Which additional step is required to resolve this error?

Accepted Answer

Enable IAM user permissions in the KMS key policy.. By default, KMS keys do not allow IAM policies to grant access unless the KMS key policy explicitly enables IAM user permissions (using the root principal `arn:aws:iam::123456789012:root`). Since the developer already has an IAM policy allowing `kms:Decrypt` on the key ARN, enabling IAM user permissions in the KMS key policy will allow that existing IAM policy to take effect and resolve the AccessDeniedException.

Answer

Add the user's ARN to the KMS key policy with 'kms:Decrypt' permission.

Answer

Attach a policy to the user that allows 'kms:DescribeKey' on the key.

Answer

Use the key ID instead of the alias in the command.

Question 6

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AES-256 (SSE-S3) and that no public access is allowed. Which TWO methods can be used to enforce these requirements across all accounts? (Choose TWO.)

Accepted Answer

Use AWS Config rules with automatic remediation to detect and fix non-compliant buckets.. AWS Config rules can evaluate S3 bucket configurations against desired settings (e.g., encryption enabled, public access blocked) and trigger automatic remediation via AWS Systems Manager Automation documents to fix non-compliant buckets. This provides continuous enforcement across all accounts in the organization without manual intervention.

Answer

Attach an IAM policy to all IAM users in each account that denies unencrypted operations.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets.

Question 7

A developer is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must authenticate users using a third-party OIDC identity provider and authorize each request. Which THREE steps should the developer take? (Choose THREE.)

Accepted Answer

Create an Amazon Cognito user pool with the OIDC identity provider configured.. Amazon Cognito user pools can be configured to federate with third-party OIDC identity providers. This allows the user pool to act as an intermediary that handles the OIDC token exchange, issuing its own JWT tokens after successful authentication. This is the standard approach for integrating external OIDC providers with AWS serverless applications.

Answer

Generate an API key and distribute it to users for authentication.

Answer

Create an IAM authorizer in API Gateway to validate the JWT token.

Question 8

A developer is tasked with encrypting data at rest for an Amazon RDS for MySQL database. The developer wants to use AWS KMS for key management. Which TWO configurations are valid? (Choose TWO.)

Accepted Answer

Create a customer managed KMS key and specify it when creating the DB instance.. You can create a customer managed KMS key and specify it when creating the DB instance. Amazon RDS for MySQL supports encryption at rest using AWS KMS, and you can choose a customer managed key at launch time. This key is used to encrypt the DB instance's storage, automated backups, read replicas, and snapshots.

Answer

Enable encryption after the DB instance is created by modifying the DB instance.

Answer

Use S3 server-side encryption (SSE-S3) with the RDS instance.

Answer

Use an AWS owned KMS key for encryption.

Question 9

A company needs to store application secrets such as database passwords and API keys. The secrets must be automatically rotated every 30 days. Which THREE AWS services or features can be used together to meet this requirement? (Choose THREE.)

Accepted Answer

AWS Lambda to implement the rotation function. AWS Lambda is correct because it can be used as a custom rotation function for AWS Secrets Manager. Secrets Manager natively supports automatic rotation using a Lambda function that updates the secret value in both the service and the database or third-party service. This allows the company to meet the 30-day rotation requirement by scheduling the Lambda function via a CloudWatch Events rule or Secrets Manager's built-in rotation schedule.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 10

Refer to the exhibit. A developer created an IAM role for a Lambda function. When the Lambda function invokes, it fails with an access denied error when trying to write logs to CloudWatch Logs. What is the most likely cause?

Accepted Answer

The role lacks a permissions policy that allows CloudWatch Logs actions.. The Lambda function's IAM role must include a permissions policy that grants the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. Without these permissions, the Lambda runtime cannot write logs to CloudWatch Logs, resulting in an access denied error. The error occurs at invocation time when the Lambda service attempts to create or write to the log stream on behalf of the function.

Answer

The trust policy does not allow the Lambda service to assume the role.

Answer

The CloudWatch Logs log group has a resource-based policy that denies the Lambda function.

Answer

The Lambda function is not associated with this role.

Question 11

A developer is troubleshooting an issue where an AWS Lambda function cannot write logs to Amazon CloudWatch Logs. The Lambda function has an execution role with a policy that allows logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Which additional configuration is likely missing?

Accepted Answer

The log group name must start with '/aws/lambda/'.. When a CloudWatch Logs log group is encrypted with a customer managed KMS key, the CloudWatch Logs service itself performs the encryption/decryption of the log data. Therefore, the KMS key policy must explicitly grant the CloudWatch Logs service principal (logs.amazonaws.com or logs.<region>.amazonaws.com) the permissions to use the key (such as kms:Encrypt, kms:Decrypt, kms:GenerateDataKey, etc.). The Lambda function's execution role does not need these KMS permissions because the function writes logs to stdout/stderr, and the Lambda service handles sending them to CloudWatch Logs.

Answer

The CloudWatch Logs log group is encrypted with a customer-managed KMS key.

Answer

The Lambda function is in a VPC without a VPC endpoint for CloudWatch Logs.

Answer

The Lambda function is not configured with a log group name.

Question 12

A developer is designing a CI/CD pipeline using AWS CodePipeline. The pipeline deploys a Lambda function. Which THREE practices should be followed to ensure security?

Accepted Answer

Use IAM roles for pipeline actions instead of access keys.. IAM roles provide temporary credentials for AWS services, eliminating the need to manage long-term access keys. CodePipeline can assume an IAM role to perform actions like deploying a Lambda function, which reduces the risk of credential leakage. This follows the principle of least privilege and is a security best practice for automated pipelines.

Answer

Use CloudFront to distribute pipeline artifacts.

Answer

Encrypt artifacts in transit using TLS.

Question 13

Which TWO AWS services can be used to protect an application running on EC2 from common web exploits like SQL injection and cross-site scripting?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting by inspecting HTTP(S) requests and blocking malicious patterns. AWS Shield Advanced is a DDoS protection service; it does not directly filter for SQL injection or XSS. Therefore, only AWS WAF is the appropriate service for this specific protection.

Answer

Amazon CloudWatch

Answer

Security Groups

Answer

AWS Shield Advanced

Answer

AWS Identity and Access Management (IAM)

Question 14

An IAM policy is attached to a user. The user tries to delete an object in 'example-bucket' from IP address 198.51.100.5. What happens?

Accepted Answer

The user is denied from deleting the object.. The question stem refers to 'An IAM policy' and the explanation mentions an explicit Deny statement and an Allow statement, but no policy JSON is actually provided in the stem. We must include the IAM policy JSON in the stem so the question can be answered.

Answer

The user can delete the object because the Allow statement grants all actions on the bucket.

Answer

The user can delete the object because there is no explicit Deny for their IP.

Answer

The user can delete the object because the Deny condition is met.

Question 15

An EC2 instance is running with an IAM instance profile. The application on the instance is trying to access an S3 bucket, but receives 'Access Denied'. The instance profile has a role with a policy that allows s3:GetObject on the bucket. What is a likely cause?

Accepted Answer

The instance is in a private subnet without a VPC endpoint for S3.. When an S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS KMS, any user or role attempting to retrieve objects from the bucket (using s3:GetObject) must also have permission to decrypt the objects using that KMS key (kms:Decrypt). Without the kms:Decrypt permission in the IAM role's policy (or the KMS key policy), AWS S3 will return an 'Access Denied' error even if the S3 permissions themselves are correct.

A missing VPC endpoint or network path (Option B) would result in a connection timeout, not an 'Access Denied' error, because the request would never reach the S3 service to be evaluated.

Answer

The instance profile is not attached to the instance.

Answer

The IAM role does not have the correct permissions.

Answer

The trust policy of the IAM role does not allow the EC2 service.