DVA-C02 Security Practice Test 18 — 15 Questions

Question 1

A company has an IAM policy that allows s3:GetObject for all users in the account. However, a specific user is receiving access denied errors. Which THREE possible causes should the developer investigate?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

An SCP at the organization level denies s3:GetObject.. Option A is correct because AWS Organizations service control policies (SCPs) act as permissions guardrails that limit the maximum permissions for accounts in the organization; an SCP that denies s3:GetObject overrides the account-level IAM allow, producing Access Denied. Option C is correct because an explicit Deny in any attached IAM policy (identity-based) always wins over an Allow in the same or another policy, so a deny statement for s3:GetObject on the user's role blocks the action. Option E is correct because S3 bucket policies are resource-based policies evaluated alongside IAM policies, and an explicit Deny in the bucket policy for that user (or principal) overrides the account's Allow, resulting in Access Denied. Option B is not correct because using an incorrect regional endpoint typically causes connection or redirect errors (e.g., 301/PermanentRedirect), not an authorization Access Denied for a valid request. Option D is not correct because cross-account access is possible when the bucket policy grants permission to the external principal; being in a different account alone does not cause Access Denied.

Answer

The user is using an incorrect region endpoint.

Answer

The S3 bucket is in a different AWS account.

Question 2

A developer is tasked with securing a legacy application that stores secrets in environment variables. Which THREE AWS services can be used to improve the security posture?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) (A) is correct because it provides managed encryption keys that can be used to encrypt secrets at rest, and it integrates with services like Secrets Manager and Parameter Store to protect the underlying data with customer master keys (CMKs). AWS Systems Manager Parameter Store (D) is correct because it offers a centralized, secure store for configuration data and secrets, supports SecureString parameters encrypted via KMS, and can be referenced by applications instead of hardcoding values in environment variables. AWS Secrets Manager (E) is correct because it is purpose-built for storing, rotating, and retrieving secrets such as database credentials and API keys, with native KMS encryption and fine-grained IAM access control. AWS Certificate Manager (B) is not correct because it manages and provisions TLS/SSL certificates for services like ELB and CloudFront, not application secrets. AWS CloudHSM (C) is not correct because it provides dedicated hardware security modules for cryptographic operations and key storage, but it is not a secrets management service for replacing environment-variable-stored secrets.

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 3

A developer runs the AWS CLI command to decrypt a file using a KMS key. What is the most likely cause of the error?

Accepted Answer

The IAM user lacks kms:Decrypt permission on the key.. The IAM user DevUser does not have kms:Decrypt permission on the specified KMS key.

Answer

The encrypted file is corrupted.

Answer

The CLI cannot read the file.

Answer

The KMS key ID is incorrect.

Question 4

A developer attaches the following IAM policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "ec2:InstanceType": "t2.micro"
        }
      }
    }
  ]
}
```

What happens when the developer attempts to launch a t2.micro instance?

Accepted Answer

The action is allowed because the Allow statement applies and the Deny condition excludes t2.micro.. AWS IAM evaluates all applicable statements, and an explicit Deny always overrides an Allow — but only when the Deny's condition evaluates to true. Here the Deny uses StringNotEquals on ec2:InstanceType with value t2.micro, so for a t2.micro launch the condition is false and the Deny does not apply. The Allow on ec2:RunInstances with Resource '*' therefore takes effect and the launch is permitted.

Answer

The action is denied because ec2:RunInstances requires additional permissions.

Answer

The action is denied because the Deny statement overrides the Allow.

Answer

The action is allowed only if the user has ec2:DescribeInstances as well.

Question 5

A developer is creating an IAM policy for an Amazon S3 bucket that must allow read access to a specific object only. Which policy element should be used to restrict access to the object?

Accepted Answer

Resource. The Resource element in an IAM policy specifies the object or bucket to which the policy applies. To allow read access to a specific object only, you must specify the object's ARN (e.g., arn:aws:s3:::bucket-name/object-key) in the Resource element. This restricts the policy's effect to that object.

Answer

Action

Answer

Condition

Answer

Principal

Question 6

A developer is troubleshooting access to an Amazon S3 bucket. The bucket policy allows access to the developer's IAM role, but the developer receives an Access Denied error when trying to upload objects. The developer is using an IAM user with access keys for API calls. What is the most likely cause?

Accepted Answer

The bucket policy allows the role ARN, but the developer is using user credentials. The bucket policy grants access to the developer's IAM role ARN, but the developer is authenticating as an IAM user with access keys. IAM roles and IAM users are distinct principals, so the role-based grant in the bucket policy does not apply to the user's credentials, resulting in Access Denied. The fix is either to assume the role or to add the IAM user ARN to the bucket policy.

Answer

The developer’s IAM user does not have s3:PutObject permission

Answer

The bucket policy does not include a Principal element

Answer

The S3 bucket is in a different region from the developer's API endpoint

Question 7

A developer needs to allow an Amazon EC2 instance to send messages to an Amazon SQS queue. What is the most secure way to grant this access?

Accepted Answer

Assign an IAM role to the EC2 instance with permissions to send messages to SQS. The most secure way to grant an EC2 instance access to SQS is to attach an IAM role to the instance with a policy allowing sqs:SendMessage on the specific queue. IAM roles provide temporary credentials via the instance metadata service (IMDS), eliminating the need to store long-lived access keys on the instance.

Answer

Create a bucket policy on S3 to allow EC2 to access SQS

Answer

Use a resource-based policy on the SQS queue allowing the EC2 instance's security group

Answer

Create an IAM user and store the credentials in the application configuration file

Question 8

A developer is using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function needs to write logs to CloudWatch Logs. Which of the following is required to allow this?

Accepted Answer

Attach an IAM policy to the Lambda execution role with CloudWatch Logs permissions. The Lambda execution role is the IAM role that Lambda assumes when the function runs, and it defines what AWS services and resources the function can access. To write logs to CloudWatch Logs, the execution role must have an IAM policy attached that grants permissions for actions like logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Without these permissions, the function cannot write logs, even if it has the necessary code. Therefore, attaching an IAM policy to the Lambda execution role with CloudWatch Logs permissions is required.

Answer

Add a resource-based policy to the Lambda function

Answer

Configure the S3 bucket to trigger Lambda, and Lambda automatically logs to CloudWatch

Answer

Create an IAM role for CloudWatch Logs and assign it to the Lambda function

Question 9

A company wants to encrypt data in transit between an on-premises application and an Amazon RDS instance. Which of the following should be implemented?

Accepted Answer

Use SSL/TLS for the database connection. Encrypting data in transit between an on-premises application and Amazon RDS requires enabling SSL/TLS on the database connection. RDS supports SSL/TLS for all supported engines, and the client must be configured to use the RDS certificate authority to establish an encrypted channel. This directly protects data as it travels over the network from the application to the database endpoint.

Answer

Use an AWS Site-to-Site VPN connection

Answer

Place the RDS instance in a private subnet and use a bastion host

Answer

Enable encryption at rest on the RDS instance

Question 10

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The developer wants to restrict access to the API so that only authenticated users can invoke it. Which API Gateway feature should be used?

Accepted Answer

API Gateway Lambda authorizer. A Lambda authorizer (formerly custom authorizer) is correct because it allows API Gateway to invoke a Lambda function that validates a token or request parameters and returns an IAM policy granting or denying access. This is the standard way to implement custom authentication logic (e.g., JWT validation, OAuth) for API Gateway REST or HTTP APIs. It directly restricts invocation to authenticated users based on the authorizer's decision.

Answer

AWS WAF

Answer

API Gateway usage plan

Answer

API Gateway resource policy

Question 11

A developer is deploying a web application on Amazon ECS with a Fargate launch type. The application needs to securely access an Amazon DynamoDB table. How should the developer grant permissions?

Accepted Answer

Define a task role for the ECS task with DynamoDB permissions. The developer should define a task role for the ECS task with DynamoDB permissions. In ECS with Fargate, the task role is an IAM role that containers can assume to make AWS API calls. This provides secure, temporary credentials without embedding secrets in the container image.

Answer

Store AWS credentials in the container image

Answer

Assign an IAM role to the ECS service and use it from the container

Answer

Use an EC2 instance profile and mount it to the container

Question 12

A company is designing a secure CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The pipeline must securely store and access sensitive parameters (e.g., API keys) used during the build. Which TWO services can be used to securely store and retrieve these parameters?

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). AWS Systems Manager Parameter Store (SecureString) and AWS Secrets Manager are both designed to securely store secrets and can be accessed by CodeBuild via IAM roles.

Answer

Amazon S3 with server-side encryption

Answer

AWS Key Management Service (KMS) alone

Answer

AWS CloudFormation parameter store

Question 13

A developer is creating an IAM policy to allow access to an Amazon DynamoDB table. The policy must allow the user to read and write items, but not to delete the table or modify its schema. Which TWO DynamoDB actions should be included in the policy?

Accepted Answer

GetItem. GetItem and PutItem are the actions for reading and writing individual items. DeleteTable and UpdateTable are administrative actions that should not be allowed.

Answer

UpdateTable

Answer

Scan

Answer

DeleteTable

Question 14

A developer needs to encrypt data at rest in an Amazon S3 bucket. Which THREE options are available for server-side encryption?

Accepted Answer

SSE-C. SSE-C (option A) is a valid server-side encryption option where the customer supplies their own encryption keys to S3, and S3 performs the encryption/decryption on the server side while the customer retains the keys. SSE-KMS (option C) is correct because S3 uses AWS KMS customer master keys (CMKs) to generate and manage the data keys used for server-side encryption, giving audit and control benefits. SSE-S3 (option D) is also correct because S3 fully manages the encryption keys with AES-256, providing server-side encryption without any key management effort from the customer. Option B (client-side encryption) is not a server-side option since the data is encrypted before it reaches S3, and option E (AWS CloudHSM) is a hardware security module service, not an S3 server-side encryption mode, although it can be used indirectly with SSE-C or custom key management.

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 15

A developer attached the IAM policy above to an IAM user. What is the effect when the user tries to download an object from the 'confidential' folder in 'example-bucket'?

Accepted Answer

The user is denied access because of the explicit Deny statement. In AWS IAM, an explicit Deny statement always overrides any Allow statement, regardless of order or specificity. The policy includes a Deny for s3:* on the confidential folder, so the user is denied access to download objects there even if a separate Allow exists.

Answer

The policy is invalid because Deny cannot be used with s3:*

Answer

The user can download only if the object is encrypted

Answer

The user can download the object because of the Allow statement