DVA-C02 Security Practice Test 17 — 15 Questions

Question 1

A developer wants to ensure that an S3 bucket only allows HTTPS requests. What S3 bucket policy condition should be used?

Accepted Answer

aws:SecureTransport. The aws:SecureTransport condition checks whether the request was sent using SSL/TLS, effectively enabling HTTPS-only access. Option A is incorrect because aws:CurrentTime is used to allow or deny access based on the time of the request. Option B is incorrect because aws:MultiFactorAuthPresent checks if the requester authenticated with multi-factor authentication. Option C is incorrect because aws:SourceIp is used to restrict requests based on the source IP address.

Answer

aws:CurrentTime

Answer

aws:MultiFactorAuthPresent

Answer

aws:SourceIp

Question 2

A developer is deploying an application with AWS CodeDeploy. The application needs to access a database password. Which service should be used to securely store and retrieve the password?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed specifically for securely storing, rotating, and retrieving secrets such as database passwords, API keys, and tokens. It integrates natively with AWS services like RDS and provides fine-grained access control via IAM. CodeDeploy deployments can retrieve secrets at runtime using the Secrets Manager API or SDK.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudFormation template parameters

Answer

Amazon DynamoDB with encryption at rest

Question 3

A developer needs to grant least-privilege access to a Lambda function to write logs to CloudWatch Logs. Which IAM policy effect should be used?

Accepted Answer

Allow. IAM policies use the Effect element with valid values of Allow or Deny; to grant least-privilege access, the policy statement must specify Effect: Allow with the specific action logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents scoped to the function's log group. Allow is the only effect that grants permissions in an identity-based policy. Deny would explicitly block the action, which is the opposite of the requirement.

Answer

Always allow

Answer

Deny

Answer

Revoke

Question 4

Which TWO actions are recommended to secure an S3 bucket? (Choose 2)

Accepted Answer

Block public access at the bucket level. Option A is correct because enabling S3 Block Public Access at the bucket level overrides any bucket policy or ACL that would otherwise grant public access, preventing accidental exposure of objects. Option D is correct because enabling default encryption (SSE-S3, SSE-KMS, or SSE-C) ensures all objects are encrypted at rest automatically, protecting data even if storage media is compromised. Option B is wrong because disabling versioning reduces recoverability from accidental deletes or overwrites and is not a security best practice. Option C is wrong because HTTP transmits data in plaintext; HTTPS (TLS) should always be used to protect data in transit. Option E is wrong because granting public read access via ACLs exposes objects to anyone on the internet, directly undermining bucket security.

Answer

Disable versioning to reduce complexity

Answer

Use HTTP instead of HTTPS for faster access

Answer

Grant public read access via ACLs

Question 5

Which THREE are valid methods to authenticate to AWS APIs? (Choose 3)

Accepted Answer

Temporary security credentials from AWS STS. Option A is correct because AWS STS issues temporary security credentials (access key ID, secret access key, and session token) via APIs like AssumeRole, GetSessionToken, or GetFederationToken, and these credentials are accepted by AWS APIs for signing requests with SigV4. Option C is correct because an EC2 instance profile delivers temporary IAM role credentials to the instance through the Instance Metadata Service (IMDS), which the AWS SDK and CLI automatically use to sign API calls. Option E is correct because a long-term IAM user access key ID and secret access key are the classic SigV4 signing credentials used to authenticate programmatic requests to AWS APIs. Option B is not a valid AWS API authentication method because a database password in Secrets Manager is a secret for connecting to a database, not an AWS credential, even though Secrets Manager itself is accessed using AWS credentials. Option D is not valid because a CloudFront key pair is used to create signed URLs or signed cookies for private content distribution, not to authenticate requests to AWS service APIs.

Answer

Database password stored in Secrets Manager

Answer

CloudFront key pair

Question 6

Which TWO are features of AWS Identity and Access Management (IAM)? (Choose 2)

Accepted Answer

Define fine-grained permissions with policies. Option C is correct because IAM's core purpose is to define fine-grained permissions using JSON policy documents that specify which principals can perform which actions on which resources under which conditions. Option E is correct because IAM natively provides identity management, allowing you to create and manage IAM users, groups, and roles, and attach policies to them for access control. Option A is incorrect because automatic S3 object encryption is a feature of Amazon S3 (e.g., SSE-S3, SSE-KMS, or default bucket encryption), not IAM. Option B is incorrect because network traffic monitoring is handled by services such as VPC Flow Logs, CloudWatch, or GuardDuty, not IAM. Option D is incorrect because EC2 instance lifecycle management is performed through EC2, Auto Scaling, or EC2 Instance Lifecycle policies, not IAM.

Answer

Encrypt S3 objects automatically

Answer

Monitor network traffic

Answer

Manage EC2 instance lifecycle

Question 7

A developer runs the above command and gets the output shown. What is the developer verifying?

Accepted Answer

The size and ETag of an object in S3. The command retrieves attributes of an object, including its size and ETag. Option A is incorrect because encryption is not checked by this command. Option C is incorrect because version ID is not part of the output shown. Option D is incorrect because the command does not test permissions; it just returns the object metadata if the user has read access.

Answer

Whether the object is encrypted

Answer

The version ID of the object

Answer

Whether the user has permissions to access the object

Question 8

A developer attaches the above S3 bucket policy to my-bucket. A user tries to upload an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The upload is denied. The bucket policy includes a Deny effect for requests where aws:SecureTransport is false (i.e., HTTP). Since the user is uploading via HTTP, the condition is true, so the Deny statement applies and the upload is denied. Explicit Deny always overrides any Allow.

Answer

The upload succeeds because the Deny effect only applies if the condition is true

Answer

The upload succeeds if the user also has an Allow in another policy

Answer

The upload succeeds because there is no Allow statement

Question 9

A developer is troubleshooting an S3 bucket policy that is denying all access. The policy has an explicit Deny for s3:PutObject. What is the most likely reason for the denial even though an Allow exists?

Accepted Answer

IAM evaluates explicit Deny before Allow.. IAM policy evaluation logic explicitly states that an explicit Deny always overrides any Allow. In S3 bucket policies, if any statement includes an explicit Deny for s3:PutObject that matches the principal and resource, the request is denied regardless of other Allow statements. This is the core reason the denial occurs even when an Allow exists.

Answer

The bucket policy has an explicit Deny for all actions.

Answer

The user is not authorized because the bucket is in a different account.

Answer

The AWS account root user has denied access.

Question 10

A developer is designing a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. Which security group configuration meets these requirements?

Accepted Answer

Web tier SG allows inbound 0.0.0.0/0 on port 80; Application tier SG allows inbound from web tier SG on port 8080.. Application tier security group should allow inbound traffic only from the web tier security group, not from the internet or CIDR ranges.

Answer

Web tier SG allows inbound from application tier SG.

Answer

Both SGs allow inbound 0.0.0.0/0 on necessary ports.

Answer

Web tier SG allows inbound 0.0.0.0/0 on port 80; Application tier SG allows inbound from 0.0.0.0/0 on port 443.

Question 11

A company uses AWS KMS to encrypt data at rest. A developer wants to allow a Lambda function to decrypt data using a KMS key. What is the minimum permissions required?

Accepted Answer

kms:Decrypt on the key in the Lambda execution role.. The minimum permission required is kms:Decrypt on the specific key, attached to the Lambda execution role. The Lambda function only needs to decrypt data, not encrypt it, so kms:Decrypt is sufficient. Granting it on the specific key follows the principle of least privilege.

Answer

kms:Decrypt on all keys.

Answer

kms:Encrypt and kms:Decrypt on the key.

Answer

Full access to KMS.

Question 12

A developer is using an S3 bucket to store sensitive files. The bucket policy includes a condition that requires TLS for all requests. A user reports that they can access the bucket via the AWS Management Console but not via an application using HTTP. What is the likely issue?

Accepted Answer

The bucket policy denies HTTP requests via aws:SecureTransport condition.. The condition aws:SecureTransport requires HTTPS; the application uses HTTP, which violates the policy.

Answer

The application is using an expired IAM access key.

Answer

The S3 bucket is in a different region.

Answer

The application is not signing requests with Signature Version 4.

Question 13

A developer needs to allow an EC2 instance to access an S3 bucket without storing credentials on the instance. Which approach is the most secure?

Accepted Answer

Use an IAM role for EC2 with a policy granting S3 access.. An IAM role attached to an EC2 instance delivers temporary, automatically rotated credentials via the Instance Metadata Service (IMDS), so no long-lived secrets ever touch the instance filesystem. The role's trust policy allows ec2.amazonaws.com to assume it, and the attached permissions policy scopes exactly which S3 actions and resources are allowed. This is AWS's recommended pattern for granting AWS service access to compute resources.

Answer

Create an IAM user with access keys and store them on the instance.

Answer

Use S3 bucket policy to allow the EC2 instance's public IP.

Answer

Store the access keys in Systems Manager Parameter Store and retrieve at runtime.

Question 14

A developer is building a serverless application using API Gateway and Lambda. The API must be accessed only by authenticated users from a specific AWS Cognito User Pool. Which method should be used?

Accepted Answer

Configure a Cognito Authorizer on the API Gateway method.. API Gateway can use a Cognito Authorizer to validate tokens from a specific user pool.

Answer

Create a Lambda authorizer that checks the token against Cognito.

Answer

Use an IAM authorizer with a policy that allows only Cognito roles.

Answer

Use a resource policy on API Gateway to restrict by source IP.

Question 15

A developer wants to encrypt data in an S3 bucket using server-side encryption with AWS KMS (SSE-KMS). Which TWO steps are required?

Accepted Answer

Set the default encryption on the bucket to SSE-KMS.. Option A is correct because configuring the bucket's default encryption to SSE-KMS ensures that objects uploaded without an explicit encryption header are automatically encrypted with AWS KMS keys (aws:kms), which is the core requirement for using SSE-KMS at the bucket level. Option D is correct because any principal writing or reading SSE-KMS-encrypted objects must have kms:GenerateDataKey (to obtain a data key for encryption) and kms:Decrypt (to decrypt the data key) permissions on the relevant KMS key; without these, S3 requests fail with AccessDenied. Option B is not required because MFA Delete only protects object version deletion and does not relate to enabling SSE-KMS. Option C is not required because a deny-unencrypted-requests bucket policy is an optional hardening measure, not a prerequisite for SSE-KMS. Option E is not required because versioning is independent of server-side encryption configuration.

Answer

Enable MFA Delete on the bucket.

Answer

Create a bucket policy that denies unencrypted requests.

Answer

Enable versioning on the bucket.