DVA-C02 Security Practice Test 19 — 15 Questions

Question 1

A developer needs to allow users from another AWS account (account ID: 123456789012) to read objects in an S3 bucket owned by the developer's account. The developer wants to use a bucket policy and does not want to create IAM users in the other account. Which bucket policy statement achieves this securely?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

{"Principal": {"AWS": "arn:aws:iam::123456789012:root"}, "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*"}. It uses the AWS account root principal ARN (arn:aws:iam::123456789012:root) to grant cross-account access to the S3 bucket. This allows any IAM user or role in the external account to read objects, provided the external account's administrator delegates permissions via IAM policies. The bucket policy does not require creating IAM users in the other account, aligning with the requirement.

Answer

{"Principal": "*", "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*", "Condition": {"StringEquals": {"aws:SourceAccount": "123456789012"}}}

Answer

{"Principal": {"AWS": "arn:aws:iam::123456789012:user/cross-account-user"}, "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*"}

Answer

{"Principal": {"AWS": "arn:aws:iam::123456789012:role/cross-account-role"}, "Action": "s3:GetObject", "Effect": "Allow", "Resource": "arn:aws:s3:::bucket/*"}

Question 2

A company wants to enforce that all uploads to an Amazon S3 bucket must be encrypted using server-side encryption. The developer needs to write an IAM policy condition that denies any s3:PutObject request that does not include the server-side encryption header. Which IAM condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption. The `s3:x-amz-server-side-encryption` condition key matches the `x-amz-server-side-encryption` request header, which is used to specify server-side encryption (SSE-S3 or SSE-KMS) for S3 PutObject requests. By denying requests that do not include this header, the policy enforces that all uploads must be encrypted at rest using server-side encryption.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id

Answer

s3:x-amz-acl

Answer

s3:x-amz-storage-class

Question 3

A company has an S3 bucket that stores sensitive data. The data is encrypted at rest using an AWS KMS customer managed key (CMK). The security team wants to ensure that only a specific IAM role in the same account can decrypt the objects. Which configuration should the developer implement?

Accepted Answer

Add a key policy that allows the IAM role to perform kms:Decrypt and denies all other principals.. KMS key policies directly control who can use the key for cryptographic operations like kms:Decrypt. By explicitly allowing only the specific IAM role and denying all other principals (including the root account), the key policy ensures that only that role can decrypt the S3 objects, regardless of any other IAM or bucket policies. This is the most secure and direct way to restrict decryption at the key level.

Answer

Add a bucket policy that denies s3:GetObject unless the request uses a specific IAM role.

Answer

Configure the S3 bucket with default encryption using the KMS key.

Answer

Create an IAM policy that grants kms:Decrypt only to the specific role.

Question 4

A developer needs to grant an IAM user in the same AWS account access to a specific object in an S3 bucket. The bucket policy currently grants access only to the bucket owner (the root account). Which identity-based policy statement should the developer add to the IAM user's permissions?

Accepted Answer

An IAM policy that allows s3:GetObject for the specific object ARN.. An IAM policy attached directly to the user can grant s3:GetObject permission for a specific object ARN (e.g., arn:aws:s3:::bucket-name/object-key). This identity-based policy overrides the bucket policy's default deny for the root-only access, as long as there is no explicit deny in the bucket policy. The bucket policy restricts access to the root account, but an explicit allow in an IAM policy can still grant access to the user since IAM policies and bucket policies are evaluated together, and an explicit allow in either can permit the action unless an explicit deny exists.

Answer

A bucket policy that allows s3:GetObject for the user.

Answer

An S3 access point policy.

Answer

An IAM policy that allows s3:ListBucket for the bucket.

Question 5

A developer wants to enforce that all requests to an Amazon S3 bucket must use HTTPS (TLS). The bucket is used for static website hosting. Which bucket policy condition should be used to deny requests that do not use HTTPS?

Accepted Answer

"aws:SecureTransport": "false". The `aws:SecureTransport` condition key evaluates to `false` when the request is not sent over HTTPS (TLS). By using a Deny effect with this condition set to `false`, the policy blocks any HTTP requests to the S3 bucket, ensuring all traffic uses encrypted connections. This is a standard approach for enforcing TLS on S3 buckets, including those used for static website hosting.

Answer

"aws:SecureTransport": "true"

Answer

"aws:SourceVpc": "true"

Answer

"aws:Referer": "https"

Question 6

A company wants to enforce that all uploads to an Amazon S3 bucket must be encrypted using server-side encryption with a specific AWS KMS customer managed key (CMK). The developer needs to write an IAM policy condition that denies any s3:PutObject request that does not use the specified KMS key. Which IAM condition key should be used?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key allows you to enforce that a specific AWS KMS customer managed key (CMK) ARN is used for server-side encryption on S3 PutObject requests. By using this condition key in a Deny statement, you can reject any upload that does not specify the required KMS key ID, ensuring encryption compliance.

Answer

s3:x-amz-server-side-encryption

Answer

kms:EncryptionContext

Answer

kms:KeyArn

Question 7

A company has an Amazon S3 bucket that stores sensitive documents. The security team wants to ensure that all GET requests to the bucket are authenticated and that the requester does not have public access. Which combination of S3 features should the developer implement?

Accepted Answer

Block public access and enable S3 Access Points with a network origin policy. Blocking public access at the bucket level ensures that no anonymous or public requests can reach the bucket, while S3 Access Points with a network origin policy restrict access to requests originating from a specific VPC or on-premises network. This combination enforces that all GET requests must be authenticated (via the Access Point's IAM policies) and cannot come from public internet sources, meeting the security team's requirements.

Answer

Enable S3 Object Lock and versioning

Answer

Use S3 Transfer Acceleration and server-side encryption

Answer

Configure a bucket policy that allows only specific IAM users and enable MFA Delete

Question 8

A developer needs to grant cross-account access to an Amazon S3 bucket. The developer's AWS account (Account A) owns the bucket, and a user in another account (Account B) needs to write objects to it. The developer has already added a bucket policy that grants the user in Account B permissions. What additional step is required?

Accepted Answer

The administrator of Account B must attach an IAM policy to the user that allows the required S3 actions.. Cross-account access to S3 requires both a resource-based policy (the bucket policy in Account A) and a user-based policy (an IAM identity-based policy in Account B). The bucket policy grants permissions to the Account B user, but that user cannot perform actions unless their own account explicitly allows those actions via an IAM policy. Without this, the request is denied by the user's own account's implicit deny, even if the bucket policy permits it.

Answer

No additional steps are needed; the bucket policy alone is sufficient.

Answer

Create a new IAM role in Account B and have the user assume the role.

Answer

Enable S3 ACLs on the bucket and grant write access to the Account B user.

Question 9

A developer is deploying an application on Amazon EC2 instances that need to securely retrieve secrets from AWS Secrets Manager. What is the MOST secure way to provide the necessary permissions without hardcoding credentials?

Accepted Answer

Attach an IAM role to the EC2 instance with permission to access Secrets Manager.. Attaching an IAM role to the EC2 instance is the most secure method because it leverages temporary security credentials obtained via the EC2 instance metadata service (IMDS). This eliminates the need to hardcode, embed, or store any long-term credentials on the instance, adhering to the AWS Well-Architected Framework's security pillar. The IAM role's policy grants the instance precise permissions to call Secrets Manager APIs like GetSecretValue, ensuring least privilege.

Answer

Store the secret in an environment variable.

Answer

Embed the secret in the application code.

Answer

Use a configuration file stored in S3 with bucket policy.

Question 10

A company requires that all objects uploaded to an Amazon S3 bucket are encrypted at rest using server-side encryption with Amazon S3 managed keys (SSE-S3). The developer wants to enforce this with a bucket policy. Which condition key and value should be used in the policy to deny uploads that do not meet this requirement?

Accepted Answer

s3:x-amz-server-side-encryption equals AES256. The condition key `s3:x-amz-server-side-encryption` with value `AES256` directly checks that the request header `x-amz-server-side-encryption` is set to `AES256`, which is the required value for SSE-S3. By using this condition in a bucket policy with a Deny effect, any upload that does not include this header or includes a different value (e.g., `aws:kms`) will be rejected, enforcing server-side encryption with Amazon S3 managed keys.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id equals alias/aws/s3

Answer

aws:SecureTransport equals true

Answer

s3:object-lock-mode equals GOVERNANCE

Question 11

A company requires that all API calls to create an Amazon S3 bucket must include a specific tag (e.g., 'CostCenter'). Which IAM policy condition key should a developer use to enforce this requirement?

Accepted Answer

aws:RequestTag. The `aws:RequestTag` condition key evaluates the tags that are included in the API request itself. When a developer attempts to create an S3 bucket, the IAM policy can use `aws:RequestTag` to require that a specific tag key (e.g., 'CostCenter') is present in the `CreateBucket` request. This ensures that the tag is applied at creation time, enforcing the company's tagging requirement.

Answer

aws:ResourceTag

Answer

s3:ExistingObjectTag

Answer

aws:TagKeys

Question 12

A company has an S3 bucket containing confidential data. The security team wants to ensure that the bucket is never publicly accessible, even if a bucket policy or ACL is incorrectly set to allow public access. Which S3 feature should the developer enable?

Accepted Answer

Enable S3 Block Public Access (bucket-level).. S3 Block Public Access (bucket-level) provides a definitive override that prevents any public access to the bucket, regardless of any bucket policies or ACLs that might otherwise grant public access. This feature acts as a safety net, ensuring that even if a policy or ACL is misconfigured to allow public access, the block public access settings will deny all public requests at the S3 service level before any policy evaluation occurs.

Answer

Enable S3 Transfer Acceleration to ensure faster uploads.

Answer

Enable S3 Server Access Logging to monitor access.

Answer

Enable S3 Object Lock to prevent objects from being deleted.

Question 13

A company wants to store database credentials securely and rotate them automatically on a schedule. The credentials are used by an AWS Lambda function to access an Amazon RDS instance. Which AWS service should the developer use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule. It natively supports automatic rotation for Amazon RDS databases (including MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) by integrating with Lambda to update the credentials in both Secrets Manager and the RDS instance. This meets the requirement for both secure storage and scheduled rotation without custom infrastructure.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Certificate Manager (ACM)

Question 14

A developer needs to grant an IAM role in the same AWS account read-only access to objects in a specific S3 bucket. The bucket is configured with a bucket policy that has an explicit Deny statement denying all principals except the root user. Which approach should the developer use to grant the required access?

Accepted Answer

Modify the bucket policy to allow the IAM role explicitly, or remove the Deny statement. The bucket policy contains an explicit Deny that overrides any allow permissions, including those granted by an IAM policy attached to the role. To grant the IAM role read-only access, the developer must either remove the Deny statement or add an explicit Allow for the role in the bucket policy, because an explicit Deny in a resource-based policy cannot be overridden by an identity-based policy.

Answer

Attach an IAM policy to the role that allows s3:GetObject on the bucket

Answer

Use an S3 access point instead of the bucket directly

Answer

Make the bucket public to allow all access

Question 15

A developer needs to grant temporary access to an Amazon S3 bucket for a user from a different AWS account. The developer wants to use the most secure method that does not require sharing long-term credentials. Which approach should the developer take?

Accepted Answer

Use cross-account IAM roles with STS AssumeRole. Using cross-account IAM roles with AWS Security Token Service (STS) AssumeRole allows the external user to obtain temporary, limited-privilege credentials without sharing any long-term access keys. This approach follows the principle of least privilege and eliminates the risk of exposed static credentials, as the temporary credentials automatically expire after a configurable duration (default 1 hour, max 12 hours).

Answer

Create an IAM user in the developer's account and share the access keys

Answer

Use S3 bucket policy with a condition for the external account's IAM user

Answer

Use S3 access control lists (ACLs) with the external user's canonical user ID