DVA-C02 Security Practice Test 16 — 15 Questions

Question 1

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated automatically every 365 days. Which type of KMS key should be used?

Accepted Answer

Use an AWS managed key (e.g., aws/s3).. AWS managed keys (e.g., aws/s3) automatically rotate every year (365 days) without any configuration or administrative action required, making them the solution with the least operational effort. While customer managed keys also support automatic rotation every 365 days, they require manual configuration to enable this feature.

Answer

Use a custom key store with automatic rotation enabled.

Answer

Use a key with imported key material and set a rotation period of 365 days.

Answer

Use a customer managed key with automatic rotation enabled.

Question 2

A company is using AWS CodeCommit and wants to ensure that all commits are signed with a GPG key. What must the developer configure?

Accepted Answer

Create a repository policy that requires commits to be signed.. AWS CodeCommit does not have resource-based 'repository policies' (permissions are managed via IAM identity-based policies). Furthermore, CodeCommit does not natively validate GPG signatures on commits, nor does it support pre-receive hooks to block unsigned commits. The features described in the explanation and Option D are entirely hallucinated.

Answer

Ask developers to sign commits using git commit -S.

Answer

Configure an SSH key in the IAM user.

Answer

Use HTTPS with a password.

Question 3

A developer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. Which TWO additional checks should the developer perform to resolve the issue?

Accepted Answer

Check if the S3 bucket policy has an explicit deny statement that affects the EC2 instance.. S3 bucket policies can explicitly deny access even if the IAM role attached to the EC2 instance grants s3:GetObject. An explicit deny in a bucket policy overrides any allow, so checking for such a deny statement is essential. Option E is correct because if the S3 bucket uses SSE-KMS encryption, the EC2 instance's IAM role must have kms:Decrypt permissions to decrypt the object; without it, GetObject requests will fail.

Answer

Check the network ACLs for the subnet.

Answer

Check if the EC2 instance is in a VPC with an S3 VPC endpoint configured.

Answer

Check the security group rules attached to the EC2 instance.

Question 4

A company is using AWS Lambda functions that access an RDS database. Which THREE practices should be followed to secure the database credentials?

Accepted Answer

Use AWS Secrets Manager to store and automatically rotate the credentials.. AWS Secrets Manager is designed to securely store, retrieve, and automatically rotate database credentials, eliminating the need to hardcode secrets. It integrates natively with RDS to manage credential rotation on a schedule you define, reducing the risk of credential exposure. This follows the AWS security best practice of using a dedicated secrets management service rather than embedding credentials in code or configuration.

Answer

Use a security group to decrypt the credentials.

Answer

Store the credentials in the Lambda function code.

Question 5

A developer is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application uses HTTPS. The developer creates a certificate in AWS Certificate Manager (ACM) and associates it with the ALB listener on port 443. However, when users access the application, they receive a browser warning that the connection is not secure. The ALB is configured with a default SSL/TLS policy. What is the most likely cause of the issue?

Accepted Answer

The certificate is in a different region than the ALB.. ACM certificates are bound to specific domain names (such as `example.com` or `*.example.com`). When a client connects to the ALB using its default DNS name (`*.elb.amazonaws.com`), the browser detects a mismatch between the requested domain name and the domain name on the SSL/TLS certificate, resulting in a 'Not Secure' or hostname mismatch warning. To resolve this, the developer should configure a custom domain name in Route 53 (or another DNS provider) pointing to the ALB via an Alias or CNAME record, and access the application using that custom domain.

Answer

The certificate was not imported correctly into ACM.

Answer

The ALB is using an outdated SSL/TLS policy.

Answer

The ALB cannot terminate HTTPS; the developer must configure HTTPS on the EC2 instances.

Question 6

A company has a centralized logging solution where all EC2 instances send logs to a CloudWatch Logs group in a central account. The EC2 instances are in a different account (App Account). The developer configures the CloudWatch agent on the instances with the necessary IAM role. However, logs are not appearing in the central account's log group. The IAM role in the App Account has permissions to put logs to the central account's log group. What is the most likely missing configuration?

Accepted Answer

The central account's log group must have a resource-based policy that grants the App Account's IAM role permissions to put logs.. For cross-account CloudWatch Logs, the destination account (central account) must attach a resource-based policy to the log group that grants the source account's IAM role (or account) permission to put log events. Without this policy, the App Account's IAM role, even with proper permissions, cannot write to the log group in the central account. Option A is incorrect because KMS encryption is not required for cross-account logging; both accounts can use different keys or no encryption. Option C is incorrect because cross-region logging is possible with additional configuration, but the issue is cross-account, not cross-region. Option D is incorrect because VPC endpoints are not mandatory for CloudWatch Logs; they are used to avoid internet traffic but are not required for functionality.

Answer

CloudWatch Logs must be encrypted with the same KMS key in both accounts.

Answer

The log group must be in the same region as the EC2 instances.

Answer

The EC2 instances must be in a VPC with a VPC endpoint for CloudWatch Logs.

Question 7

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. However, the application receives an AccessDenied error. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AppRole"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

The EC2 instance is using the correct IAM role. What is the most likely cause of the error?

Accepted Answer

The IAM role attached to the EC2 instance has a different ARN than the one specified in the bucket policy.. The bucket policy explicitly allows access only to the IAM role with the exact ARN 'arn:aws:iam::123456789012:role/AppRole'. The EC2 instance uses its attached IAM role, but if that role's ARN differs from the one in the bucket policy, S3 denies the request. Even though the IAM role policy grants s3:GetObject, the resource-based bucket policy overrides the permission and requires a matching principal. Therefore, the most likely cause is that the IAM role attached to the EC2 instance has a different ARN than the one specified in the bucket policy, making option B correct.

Answer

The bucket uses default encryption with SSE-S3, and the application does not support it.

Answer

The IAM role policy allows s3:GetObject, but the bucket policy also must allow it, which it does.

Answer

The bucket policy requires MFA, but the application does not provide it.

Question 8

A developer is designing a serverless application using API Gateway, Lambda, and DynamoDB. The API must authenticate users using a JWT token. Which API Gateway feature should the developer use to validate the JWT before invoking the Lambda function?

Accepted Answer

Use a Lambda authorizer (custom authorizer).. A Lambda authorizer (custom authorizer) is required to validate JWTs issued by a third-party identity provider (IdP) in API Gateway REST APIs. While Amazon Cognito user pool authorizers can natively validate Cognito-issued JWTs, they cannot validate tokens from external providers. A Lambda authorizer allows you to run custom code to verify the signature, expiration, and claims of any third-party JWT before routing the request to the backend Lambda function.

Answer

Use an IAM authorizer with a resource policy.

Answer

Use an Amazon Cognito user pool authorizer.

Answer

Use an API Gateway resource policy to allow only authenticated IPs.

Question 9

A company wants to encrypt data at rest in an S3 bucket. Which AWS service can provide encryption keys that are managed by AWS and rotated automatically?

Accepted Answer

SSE-KMS (Server-Side Encryption with AWS KMS). SSE-KMS (Server-Side Encryption with AWS KMS keys) allows you to use AWS KMS to encrypt your S3 objects. AWS KMS provides AWS managed keys (such as `aws/s3`) which are managed by AWS and rotated automatically every year. Additionally, AWS KMS provides a complete audit trail of key usage via AWS CloudTrail, allowing you to track when and by whom a key was used. SSE-S3 also manages and rotates keys automatically, but it does not provide an audit trail of key usage.

Answer

SSE-S3 (Server-Side Encryption with S3 Managed Keys)

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys)

Answer

Client-side encryption using AWS KMS.

Question 10

A developer is deploying an application on EC2 instances behind an Application Load Balancer. The application must support mutual TLS (mTLS) authentication between clients and the load balancer. Which configuration is required?

Accepted Answer

Create a trust store in AWS Certificate Manager Private CA and associate it with the ALB.. Mutual TLS (mTLS) on an Application Load Balancer (ALB) requires a trust store containing the trusted Certificate Authority (CA) certificates used to validate client certificates. This trust store is created and managed directly within Elastic Load Balancing (ELB) and then associated with the ALB's listener. The ALB then performs client certificate verification during the TLS handshake, offloading this overhead from the backend EC2 instances.

Answer

Use a Network Load Balancer (NLB) with TLS listeners.

Answer

Configure listener rules on the ALB to require client certificates.

Answer

Use Amazon CloudFront with a custom origin and require client certificates.

Question 11

A company is using AWS KMS to encrypt data in S3. Which TWO actions are required to allow an IAM user to decrypt objects in a specific S3 bucket?

Accepted Answer

Attach a policy to the user allowing s3:GetObject on the bucket.. To decrypt an object stored in S3 using server-side encryption with AWS KMS (SSE-KMS), the IAM user must have the s3:GetObject permission to retrieve the encrypted object from the bucket. Without this permission, the user cannot even initiate the GetObject request, regardless of KMS permissions.

Answer

Attach a policy to the user allowing kms:Encrypt.

Answer

Attach a policy to the user allowing s3:PutObject.

Answer

Attach a policy to the user allowing kms:GenerateDataKey.

Question 12

A developer is configuring an S3 bucket to host a static website. The bucket must be accessible to anyone on the internet, but only for reading objects. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Enable static website hosting on the bucket.. Enabling static website hosting on the S3 bucket is a prerequisite for serving content as a website. Without this setting, the bucket cannot serve HTTP requests for web pages, even if objects are publicly readable. This configuration provides an endpoint URL and allows index and error document routing.

Answer

Set the bucket ACL to public-read.

Answer

Create an Amazon CloudFront distribution with the bucket as origin.

Question 13

A company wants to securely store database credentials for a Lambda function. The credentials must be automatically rotated. Which TWO services should be used together?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials and other secrets. It integrates natively with AWS Lambda and supports automatic rotation via a built-in rotation function or a custom Lambda function, meeting the requirement for automated credential rotation without manual intervention.

Answer

AWS KMS

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 14

An application running on EC2 instances needs to access an S3 bucket securely. Which of the following is the BEST practice for managing credentials?

Accepted Answer

Launch the EC2 instance with an IAM role that grants S3 access.. Assigning an IAM role to an EC2 instance is the AWS-recommended best practice for securely granting permissions to AWS services. The instance automatically obtains temporary security credentials from the instance metadata service (IMDS), eliminating the need to hardcode or manage long-term access keys. This approach follows the principle of least privilege and avoids the security risks of storing credentials on disk.

Answer

Store the AWS access key and secret key in a configuration file on the EC2 instance.

Answer

Use an IAM user with programmatic access and attach a policy allowing S3 access.

Answer

Use a shared secret key stored in AWS Secrets Manager and retrieve it at runtime.

Question 15

Refer to the exhibit. An S3 bucket policy is set as shown. A developer tries to download an object from my-bucket using the AWS CLI from an IP address in the 203.0.113.0/24 range. What will happen?

Accepted Answer

The download fails with an AccessDenied error.. In an S3 bucket policy, explicit Deny statements override any Allow statements. Even though the Allow statement grants s3:GetObject to all principals, the Deny statement explicitly denies s3:GetObject when the request originates from the 203.0.113.0/24 IP range. Since the developer's IP falls within that range, the Deny takes precedence, resulting in an AccessDenied error.

Answer

The policy is invalid because of conflicting statements.

Answer

The download succeeds because the Allow statement matches the request.

Answer

The download succeeds because the Deny statement does not apply to GetObject.