DVA-C02 Security Practice Test 19 — 15 Questions

Question 1

A developer is troubleshooting an AccessDenied error when a Lambda function tries to write to CloudWatch Logs. The function's IAM role includes the following policy. Which TWO missing permissions are causing the error? (Choose TWO.)

Accepted Answer

logs:CreateLogStream. Option C is correct because a Lambda function must call logs:CreateLogStream before it can write log events to a specific log stream. Without this permission, the function cannot create a new log stream when one does not already exist, resulting in an AccessDenied error. Option E is correct because logs:PutLogEvents is the permission required to actually write log events to an existing log stream; without it, the function cannot send log data to CloudWatch Logs.

Answer

logs:DescribeLogStreams

Answer

logs:CreateLogGroup

Answer

logs:GetLogEvents

Question 2

A company wants to enforce multi-factor authentication (MFA) for all IAM users accessing the AWS Management Console. Which THREE actions are required?

Accepted Answer

Instruct users to use their MFA device when logging in. Option A is correct because instructing users to use their MFA device when logging in is a necessary step to ensure that users know how to properly authenticate with their assigned MFA device (e.g., virtual TOTP token or hardware key fob) during the AWS Management Console login process. Without this instruction, users may not complete the MFA challenge, leaving the policy enforcement ineffective. This action complements the technical enforcement by providing user guidance.

Answer

Configure a password policy that requires MFA

Answer

Create a service control policy (SCP) to enforce MFA

Question 3

A company runs a containerized application on Amazon ECS using Fargate. The application needs to access an S3 bucket to read configuration files and a DynamoDB table to store session state. The ECS task role is configured with the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "dynamodb:PutItem",
        "dynamodb:GetItem"
      ],
      "Resource": "*"
    }
  ]
}

The application fails to read from the S3 bucket and write to DynamoDB. The error messages indicate AccessDenied. The S3 bucket has a bucket policy that denies all access unless the request includes a specific aws:SourceIp condition. The DynamoDB table has a resource-based policy that allows access only from the VPC endpoint. The ECS tasks are running in a private subnet with a VPC endpoint for DynamoDB but no VPC endpoint for S3. Which action should be taken to resolve the errors?

Accepted Answer

Create a VPC endpoint for S3 and modify the S3 bucket policy to allow access from the VPC endpoint. The application fails because the S3 bucket policy denies access unless the request includes a specific `aws:SourceIp` condition, but the ECS tasks in a private subnet have no public IP and no VPC endpoint for S3. Without a VPC endpoint, traffic to S3 traverses the internet via a NAT gateway, but the bucket policy explicitly requires a specific source IP, which the NAT gateway's public IP does not match (or is not allowed). Option D resolves this by creating a VPC endpoint for S3 and modifying the bucket policy to allow access from the VPC endpoint, bypassing the IP condition and enabling private connectivity.

Answer

Add s3:ListBucket to the task role policy and ensure the S3 bucket policy allows the task role ARN

Answer

Attach a NAT gateway to the private subnet and update the S3 bucket policy to allow the NAT gateway's public IP

Answer

Modify the task role policy to restrict resource ARNs to the specific S3 bucket and DynamoDB table

Question 4

A company is using AWS Secrets Manager to rotate database credentials automatically. The rotation Lambda function fails with a timeout. Which action should be taken to resolve this issue?

Accepted Answer

Increase the Lambda function timeout.. The Lambda function is timing out during the rotation process, which indicates that the default 3-second timeout is insufficient for the rotation logic. Increasing the Lambda function timeout (Option B) directly addresses this by allowing the function more time to complete the rotation, such as calling the Secrets Manager API, updating the database, and verifying the new credentials.

Answer

Reduce the rotation schedule interval.

Answer

Place the Lambda function in a VPC with a NAT gateway.

Answer

Store the rotation schedule in EC2 user data.

Question 5

A developer needs to grant an IAM user read-only access to an S3 bucket named 'my-bucket'. Which IAM policy statement should be attached?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::my-bucket","arn:aws:s3:::my-bucket/*"]}. Option B is correct because it grants read-only access by allowing the `s3:GetObject` action (to read objects) and the `s3:ListBucket` action (to list objects in the bucket). The resources are correctly specified: `arn:aws:s3:::my-bucket` for the bucket-level `ListBucket` action and `arn:aws:s3:::my-bucket/*` for the object-level `GetObject` action. This combination provides the minimal permissions needed for read-only access without allowing write or delete operations.

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Deny","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":["s3:PutObject","s3:DeleteObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 6

A developer is using AWS KMS to encrypt data in an S3 bucket. The developer wants to ensure that the S3 bucket uses server-side encryption with AWS KMS managed keys (SSE-KMS) by default. Which configuration should be applied?

Accepted Answer

Set the bucket's default encryption to SSE-KMS with a KMS key.. Option D is correct because setting the bucket's default encryption to SSE-KMS with a KMS key ensures that all objects uploaded to the S3 bucket are automatically encrypted using server-side encryption with AWS KMS managed keys (SSE-KMS). This configuration enforces encryption at rest without requiring the client to specify encryption headers in the request, meeting the requirement for default SSE-KMS encryption.

Answer

Add a bucket policy that denies PutObject without the 'x-amz-server-side-encryption' header set to 'aws:kms'.

Answer

Configure the bucket to use SSE-C with a customer-provided key.

Answer

Set the bucket's default encryption to SSE-S3.

Question 7

A company uses AWS IAM roles to grant permissions to EC2 instances. An application running on an instance fails to access an S3 bucket. The IAM role has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. What is the likely cause?

Accepted Answer

The policy does not include s3:ListBucket permission.. The IAM policy allows only `s3:GetObject` on objects within `my-bucket`, but the application likely needs to list the bucket's contents first (e.g., via `s3:ListBucket`) to know which objects to retrieve. Without `s3:ListBucket` permission on the bucket resource (`arn:aws:s3:::my-bucket`), any attempt to list objects (such as through the AWS CLI `aws s3 ls` or SDK operations like `listObjects`) will fail with an AccessDenied error, even though `GetObject` is allowed. This is a common oversight when granting S3 access, as listing is a separate action required for many operations.

Answer

The instance does not have an instance profile.

Answer

The trust policy of the role does not allow EC2 to assume it.

Answer

The IAM role is not attached to the EC2 instance.

Question 8

A developer wants to securely store database credentials for a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager is designed to store and rotate secrets. Option A is wrong because Parameter Store can store secrets but is not as feature-rich for rotation. Option C is wrong because DynamoDB is a database, not a secret store. Option D is wrong because S3 is not secure by default for secrets.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3 with server-side encryption

Answer

Amazon DynamoDB

Question 9

A company uses AWS CloudTrail to log all API calls. The security team wants to be notified immediately when an IAM user creates a new access key. Which solution is most efficient?

Accepted Answer

Create a CloudWatch Events rule that matches the CreateAccessKey API call and triggers a Lambda function to send an SNS notification.. Option B is correct because CloudWatch Events (now Amazon EventBridge) can directly match the CreateAccessKey API call from CloudTrail and trigger a Lambda function to send an SNS notification in near real-time. This is the most efficient solution as it avoids the overhead of log ingestion, metric filters, or periodic queries, providing immediate notification with minimal latency.

Answer

Configure CloudTrail to send logs to CloudWatch Logs and create a metric filter with an alarm.

Answer

Enable CloudTrail log file validation and periodically check the logs.

Answer

Use Amazon Athena to query CloudTrail logs daily.

Question 10

A developer needs to allow an EC2 instance to read from a DynamoDB table. Which is the best practice to grant permissions?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance.. The best practice for granting an EC2 instance permissions to access DynamoDB is to create an IAM role with the required permissions and attach it to the instance. This eliminates the need to manage long-term credentials, as the instance automatically retrieves temporary security credentials from the instance metadata service (IMDS) via the AWS Security Token Service (STS). This approach follows the principle of least privilege and ensures credentials are rotated automatically.

Answer

Generate an IAM user access key and store it in the application configuration.

Answer

Hardcode the AWS credentials in the application code.

Answer

Add the DynamoDB table ARN to the EC2 instance's security group.

Question 11

A developer is building a web application that must encrypt data in transit between the client and the server. Which AWS service should be used to offload SSL/TLS termination?

Accepted Answer

Application Load Balancer (ALB). An Application Load Balancer (ALB) supports SSL/TLS termination by decrypting HTTPS traffic from clients and forwarding it as HTTP to backend targets. This offloads the cryptographic processing from application servers, reducing their CPU load and centralizing certificate management. ALB uses listener rules with SSL/TLS certificates stored in AWS Certificate Manager (ACM) or uploaded via IAM, and it supports TLS 1.2 and 1.3 protocols.

Answer

Amazon CloudFront

Answer

Network Load Balancer (NLB)

Answer

Amazon Route 53

Question 12

A company has an S3 bucket that contains sensitive data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS. Which combination of actions will enforce this?

Accepted Answer

Use a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not 'aws:kms'.. Option D is correct because a bucket policy that denies PutObject requests when the `x-amz-server-side-encryption` header is not set to `aws:kms` enforces encryption at rest using AWS KMS for all uploads. This policy explicitly rejects any upload that does not include the required KMS encryption header, ensuring compliance with the security team's requirement. Default encryption settings (like SSE-S3 or SSE-KMS) can be overridden by the client, so a bucket policy is the only way to enforce encryption at the API level.

Answer

Configure the bucket to use SSE-S3 by default.

Answer

Enable default encryption on the bucket with SSE-KMS.

Answer

Use a bucket policy that allows only PutObject with KMS encryption.

Question 13

A developer is configuring a Lambda function to access a DynamoDB table in a VPC. Which TWO steps are required to ensure the Lambda function can securely access DynamoDB? (Select TWO.)

Accepted Answer

Attach the Lambda function to a VPC.. Option B is correct because attaching the Lambda function to a VPC allows it to access resources within the VPC, such as a DynamoDB table accessed via a VPC endpoint. Without VPC attachment, the Lambda function runs outside the VPC and cannot use VPC endpoints or security groups. Option C is correct because a VPC endpoint for DynamoDB (using AWS PrivateLink) enables private connectivity between the VPC and DynamoDB without traversing the public internet, which is required for secure access from a Lambda function in the VPC.

Answer

Configure a NAT gateway in the VPC.

Answer

Add a route to the DynamoDB service in the subnet's route table.

Answer

Assign a security group to the Lambda function that allows outbound traffic to DynamoDB.

Question 14

A security audit reveals that an S3 bucket is publicly accessible. The bucket policy is as follows: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":"*","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. Which TWO actions should be taken to remediate this issue? (Select TWO.)

Accepted Answer

Remove the public access grant from the bucket ACL.. Option A is correct because the bucket ACL may still grant public access even if the bucket policy is the primary issue. Removing the public access grant from the ACL ensures that no anonymous principals have s3:GetObject permissions via ACLs, which is a separate access control mechanism from bucket policies. This is a direct remediation step to eliminate public read access.

Answer

Create an IAM user policy that denies s3:GetObject for anonymous users.

Answer

Enable versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 15

A developer is creating an IAM policy for a Lambda function that needs to read from an SQS queue and write to a DynamoDB table. Which THREE permissions are required? (Select THREE.)

Accepted Answer

sqs:DeleteMessage. A is correct because the Lambda function must delete messages from the SQS queue after processing them to prevent them from being reprocessed. The sqs:DeleteMessage permission is required to call the DeleteMessage API, which removes the message from the queue using its receipt handle. Without this permission, the function would successfully receive and process the message but fail to delete it, causing the message to become visible again after the visibility timeout expires.

Answer

sqs:SendMessage

Answer

dynamodb:GetItem

DVA-C02 Security Practice Test 19 — 15 Questions

Exhibit

DVA-C02 Security Practice Test 19 — 15 Questions

Exhibit