DVA-C02 Security Practice Test 16 — 15 Questions

Question 1

A developer is using AWS Lambda to process sensitive data. The Lambda function needs to access a DynamoDB table that is encrypted with a customer-managed CMK. The developer is using the default Lambda execution role. What must be done to allow Lambda to decrypt the DynamoDB table?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Add a policy to the KMS key that allows the Lambda execution role to perform kms:Decrypt.. The DynamoDB table is encrypted with a customer-managed CMK. The Lambda execution role must be granted permission to use that key. This is done by adding a statement to the KMS key's key policy that allows the Lambda execution role to perform kms:Decrypt. DynamoDB will then perform the decryption on behalf of Lambda. Option A is incorrect because dynamodb:GetItem alone does not grant KMS decrypt permissions. Option C is incorrect because a VPC endpoint is not related to KMS permissions. Option D is incorrect because Lambda does not need to directly call the KMS Decrypt API; the key policy handles the authorization.

Answer

Add a policy to the Lambda execution role allowing dynamodb:GetItem.

Answer

Configure a VPC endpoint for DynamoDB.

Answer

Modify the Lambda function to call KMS Decrypt API.

Question 2

A developer is configuring a load balancer in front of an EC2 instance running a web application. The application needs to authenticate users via an identity provider. Which AWS service should the developer use to handle authentication and authorization?

Accepted Answer

Amazon Cognito. Amazon Cognito is designed to handle user authentication and authorization for web and mobile applications. It provides user pools for sign-up/sign-in and identity pools for federated identities, allowing integration with external identity providers (IdPs) like Google, Facebook, and SAML. Since the application needs to authenticate users via an identity provider, Cognito is the correct choice.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon Route 53

Answer

Amazon CloudFront

Question 3

A company wants to encrypt data in transit between an EC2 instance and an S3 bucket. What should they do?

Accepted Answer

Use the S3 HTTPS endpoint for all API calls.. Data in transit between EC2 and S3 is encrypted by using the S3 HTTPS endpoint for all API calls, which uses TLS/SSL to encrypt the connection. Option A is incorrect because S3 does not support SSH transfers; SSH is used for secure shell access, not for S3 API calls. Option B is incorrect because S3 does not support VPN connections; VPN is used for network-level encryption between on-premises networks and AWS, not directly between EC2 and S3. Option C is incorrect because client-side encryption encrypts data before sending, but it does not address encryption in transit; HTTPS is the standard for in-transit encryption, and client-side encryption is for data at rest on the client side.

Answer

Use SSH to transfer files to S3.

Answer

Establish a VPN connection between the instance and S3.

Answer

Enable client-side encryption using the AWS SDK.

Question 4

A developer is storing secrets such as database passwords. Which TWO AWS services can be used to securely store and retrieve secrets?

Accepted Answer

AWS Systems Manager Parameter Store. AWS Systems Manager Parameter Store (B) is correct because it can store secrets as SecureString parameters, which are encrypted with AWS KMS and can be retrieved programmatically by applications via the SSM API, making it a valid service for storing and retrieving database passwords. AWS Secrets Manager (D) is correct because it is purpose-built for storing, retrieving, and rotating secrets such as database credentials, using KMS encryption and APIs like GetSecretValue. AWS CloudHSM (A) is not correct here because it provides dedicated hardware security modules for cryptographic key operations, not a managed secret storage and retrieval service. AWS Identity and Access Management (C) manages identities, permissions, and policies rather than storing secret values. Amazon S3 (E) is object storage and, while it can be encrypted, it is not designed as a secrets management service for securely storing and retrieving credentials.

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon S3

Question 5

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they can access objects in the S3 bucket from their office IP address (192.0.2.15) but cannot access from home (203.0.113.5). What is the most likely reason?

Accepted Answer

The policy restricts access based on source IP address.. The correct option is C: the policy restricts access based on source IP address. Since the user can access the S3 bucket from the office IP 192.0.2.15 but not from the home IP 203.0.113.5, the IAM policy most likely includes a Condition element using aws:SourceIp (or NotIpAddress) that allows only the office IP range. Options A, B, and D do not fit: a VPC requirement would not explain why the office IP works, a bucket policy denying the user would block both locations, and a blanket Deny on s3:GetObject would also block access from the office.

Answer

The policy requires requests to originate from a VPC.

Answer

The bucket policy does not allow the user.

Answer

The policy denies all s3:GetObject actions.

Question 6

A developer is creating an IAM policy to allow an EC2 instance to access an S3 bucket. Which AWS service should the developer use to securely provide credentials to the EC2 instance?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. IAM roles are designed to be assumed by AWS services like EC2. Instance profiles deliver temporary credentials to the EC2 instance automatically, avoiding hard-coded keys. Option A is incorrect because Cognito identity pools are intended for user identity in mobile/web apps, not for EC2 instances. Option B is incorrect because storing IAM user access keys on the instance is insecure and not recommended. Option D is incorrect because AWS Secrets Manager is for managing secrets such as database credentials, not for providing credentials to EC2 instances. Option C is the correct approach: create an IAM role with the necessary S3 permissions and attach it to the EC2 instance profile.

Answer

Use Amazon Cognito identity pools to generate temporary credentials for the instance.

Answer

Create an IAM user with access keys and store them on the instance.

Answer

Store the AWS access key in AWS Secrets Manager and retrieve it at runtime.

Question 7

A company is using AWS CodePipeline to deploy a web application. The pipeline must securely store and use database credentials. Which AWS service should the developer use to store the credentials and retrieve them during deployment?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving sensitive credentials like database passwords. It integrates natively with CodePipeline/CodeBuild via the AWS CLI or SDK, supports automatic rotation via Lambda, and provides fine-grained IAM access control and encryption with KMS. This makes it the correct choice for securely storing and retrieving database credentials during deployment.

Answer

IAM role attached to the CodePipeline service role.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Amazon DynamoDB with server-side encryption.

Question 8

A developer is deploying an application on EC2 that must access an S3 bucket. The developer wants to avoid hard-coding credentials. What is the MOST secure way to grant access?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. Attaching an IAM role to the EC2 instance profile lets the instance obtain temporary, automatically rotated credentials from the EC2 instance metadata service (IMDS), so no long-lived secrets exist on the instance or in code. This is the AWS-recommended best practice for EC2-to-S3 access and eliminates the risk of credential leakage. The SDKs and CLI automatically retrieve and refresh these credentials.

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP address.

Answer

Set the AWS credentials as environment variables in the user data script.

Answer

Store the AWS access key ID and secret access key in a configuration file on the instance.

Question 9

A developer needs to encrypt data in an S3 bucket. The company requires that the encryption key be managed by AWS but with the ability to audit key usage. Which S3 encryption option should the developer use?

Accepted Answer

Server-Side Encryption with AWS KMS (SSE-KMS).. SSE-KMS uses AWS Key Management Service (KMS) to manage the encryption keys, and it provides audit trails of key usage via AWS CloudTrail. This meets the requirement of AWS-managed keys with auditability. SSE-S3 uses S3-managed keys but does not provide detailed audit logs of key usage. Client-side encryption and SSE-C involve customer-managed keys, which do not meet the 'managed by AWS' requirement.

Answer

Client-side encryption.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3).

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C).

Question 10

A developer is using Amazon API Gateway with a Lambda authorizer to secure a REST API. The developer wants to pass user context from the authorizer to the backend Lambda function. How should the developer accomplish this?

Accepted Answer

Return a context object from the Lambda authorizer that maps to integration request parameters.. The Lambda authorizer can return a context object alongside the IAM policy. This context object can be mapped to integration request parameters (such as headers or path parameters) using API Gateway's mapping templates or passthrough behavior. The backend function then receives the user context via those parameters. Option D is correct because returning a context object from the authorizer and mapping it to integration request parameters is the standard method. Option A is incorrect because the principal identifier is a single field, not suitable for passing multiple context values. Option B is incorrect because the authorization token is the input to the authorizer, not the output. Option C is incorrect because custom headers are not automatically mapped to resource path parameters; such a mapping would not pass user context from the authorizer.

Answer

Include the user context in the principal identifier returned by the authorizer.

Answer

Encode the user context in the authorization token.

Answer

Use a custom header that maps to a resource path parameter.

Question 11

A company has a multi-account architecture using AWS Organizations. The security team wants to centrally manage IAM policies that apply to all accounts. Which AWS feature should the developer use?

Accepted Answer

Service control policies (SCPs) in AWS Organizations.. Service control policies (SCPs) in AWS Organizations are the only feature that lets you centrally define and enforce permission guardrails across every account in the organization. SCPs are attached at the OU or account level and define the maximum permissions available to IAM principals in member accounts, so a single policy change propagates to all accounts. This directly satisfies the requirement to 'centrally manage IAM policies that apply to all accounts.'

Answer

IAM cross-account roles.

Answer

AWS Config conformance packs.

Answer

IAM policies attached to the root user.

Question 12

A developer wants to ensure that an S3 bucket is not publicly accessible. Which TWO measures should the developer implement?

Accepted Answer

Review the bucket policy to ensure it does not allow public access.. Option D is correct because the bucket policy is the resource-based policy that can explicitly grant public access (for example, a Principal of "*" with s3:GetObject), so reviewing it to confirm it does not allow public access is a direct way to prevent the bucket from being publicly accessible. Option E is correct because S3 Block Public Access settings, when enabled on the bucket, override any bucket policy or ACL that would otherwise make objects public, providing a strong account- or bucket-level safeguard against public exposure. Option A is incorrect because S3 server access logging only records requests made to the bucket for auditing purposes; it does not restrict or prevent public access. Option B is incorrect because versioning preserves multiple versions of objects for recovery and rollback, but it has no effect on whether the bucket or its objects are publicly accessible. Option C is incorrect because default encryption protects data at rest but does not control who can access the objects, so it does not prevent public accessibility.

Answer

Enable S3 server access logging.

Answer

Enable versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 13

The exhibit shows an IAM policy attached to a Lambda function's execution role. When the Lambda function tries to decrypt data using the KMS key, it receives an access denied error. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the Lambda execution role permission to use the key.. The most likely cause is that the KMS key policy does not grant the Lambda execution role permission to use the key. Even if the IAM policy attached to the role includes kms:Decrypt, the KMS key policy must also allow the role to use the key. KMS requires both identity-based and resource-based policies to grant access.

Answer

The policy uses an incorrect action name for decryption.

Answer

The policy does not include kms:DescribeKey permission.

Answer

The policy does not include kms:Decrypt permission.

Question 14

A developer needs to allow an EC2 instance to read objects from a specific S3 bucket. Which is the MOST secure way to grant permissions?

Accepted Answer

Create an IAM role with S3 read permission and attach it to the EC2 instance as an instance profile. Creating an IAM role with S3 read permission and attaching it to the EC2 instance as an instance profile is the most secure way because it provides temporary, automatically rotated credentials to the instance without storing any long-term secrets. The instance profile delivers credentials via the EC2 instance metadata service (IMDS), and the role's policy can be scoped to only the specific S3 bucket and read actions needed. This eliminates the risk of leaked access keys.

Answer

Store AWS access keys in the EC2 instance's user data

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP

Answer

Attach a security group to the EC2 instance that allows S3 access

Question 15

A developer is encrypting an S3 bucket using server-side encryption with AWS KMS (SSE-KMS). What is a benefit of using SSE-KMS over SSE-S3?

Accepted Answer

Ability to control access to the encryption key separately. SSE-KMS allows you to use AWS KMS customer master keys (CMKs) to encrypt objects, giving you control over key access through KMS key policies and IAM. This separation of key management from data management is a key benefit over SSE-S3, where AWS manages the keys entirely. Thus, the ability to control access to the encryption key separately is the correct benefit.

Answer

Reduced latency for encrypted object retrieval

Answer

Lower cost than SSE-S3

Answer

Automatic encryption of objects at rest