DVA-C02 Security Practice Test 2 — 15 Questions

Question 1

A company wants to securely store secrets for a Lambda function. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the ideal choice when automatic rotation of secrets (such as database credentials) is required. While AWS Systems Manager Parameter Store can securely store secrets using SecureString parameters, it does not support native automatic rotation. By specifying the need for automatic rotation in the stem, AWS Secrets Manager becomes the uniquely correct answer.

Answer

Amazon S3 with server-side encryption

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 2

A developer is writing a Lambda function that needs to access an RDS database. The function currently fails with a timeout. What is the most likely cause?

Accepted Answer

The Lambda function is not in the same VPC as the RDS instance. When a Lambda function needs to reach an RDS instance in a VPC, the function itself must be configured with VPC access (subnets and security groups) in the same VPC as the RDS instance. If Lambda runs outside the VPC, it cannot route to the RDS private IP, causing connection timeouts. This is the most common cause of Lambda-to-RDS timeouts in AWS.

Answer

The Lambda function has a cold start delay

Answer

The RDS instance is not publicly accessible

Answer

The Lambda function does not have an IAM role granting RDS access

Question 3

Which THREE are valid methods to encrypt data at rest in Amazon S3? (Choose 3)

Accepted Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3). Amazon S3 supports both server-side encryption and client-side encryption for data at rest. SSE-S3 (B), SSE-C (D), and SSE-KMS (E) are valid server-side options, and client-side encryption with AWS KMS (C) is also an officially supported method. Option A is encryption in transit, not at rest. Therefore the correct answer should include C as well, making the stem's 'Choose 3' invalid as written.

Answer

Encryption in transit using SSL/TLS

Question 4

A developer is building a serverless application using AWS Lambda. The application needs to access a DynamoDB table and an S3 bucket. What is the MOST secure way to provide the necessary permissions?

Accepted Answer

Create an IAM role with appropriate policies and attach it to the Lambda function.. IAM roles for Lambda functions are the secure way to grant permissions without hardcoding credentials. Option B is wrong because resource-based policies are typically used for granting cross-account access, not for granting permissions to a Lambda function within the same account; IAM roles are the appropriate mechanism. Option C is wrong because inline policies cannot be attached directly to a Lambda function; Lambda uses IAM roles. Option D is wrong because storing AWS access keys in environment variables is insecure and should be avoided; IAM roles are preferred.

Answer

Use a resource-based policy on the DynamoDB table and S3 bucket to grant access to the Lambda function.

Answer

Attach an inline policy directly to the Lambda function resource.

Answer

Store AWS access keys in environment variables of the Lambda function.

Question 5

A developer is designing a system that must meet the following security requirements: (1) Encrypt data at rest in S3, (2) Automatically rotate encryption keys annually, (3) Use an encryption key that is managed by AWS. Which services or features should the developer use? (Choose TWO.)

Accepted Answer

SSE-KMS. SSE-KMS (B) is correct because it uses AWS KMS customer master keys that AWS manages, supports automatic annual key rotation via KMS key rotation settings, and encrypts S3 objects at rest with AES-256. SSE-S3 (C) is correct because it uses AWS-managed keys (S3-managed, AES-256) that are automatically rotated by AWS, satisfying the requirement for an AWS-managed key with automatic rotation, though the rotation is handled transparently by AWS rather than configurable. SSE-C (A) is not correct because the customer supplies and manages the encryption key, so AWS does not manage or rotate it. AWS CloudHSM (D) is not correct because it is a customer-managed hardware security module, not an AWS-managed key service for S3 at-rest encryption. Client-side encryption with AWS KMS (E) is not correct because the data is encrypted before reaching S3 and the key management/rotation is the customer's responsibility, not an AWS-managed S3 encryption feature.

Answer

SSE-C

Answer

AWS CloudHSM

Answer

Client-side encryption with AWS KMS

Question 6

A developer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket despite having an IAM role with the correct permissions attached. Which THREE steps should the developer take to diagnose the issue?

Accepted Answer

Check the security group of the EC2 instance for outbound rules.. Options B, C, and D are correct. Option B: Security group outbound rules must allow HTTPS (port 443) to reach S3; a missing outbound rule can block access. Option C: Checking for explicit Deny statements in the IAM policy helps identify if any deny is overriding the allow permissions. Option D: Verifying that the IAM role is correctly associated with the instance ensures the instance actually has the role attached. Option A is incorrect because 'aws sts assume-role' is used to assume a different role, not to test the instance's current role credentials; to validate the instance's role, you would use 'aws sts get-caller-identity'. Option E is incorrect because modifying the bucket policy to grant access to a security group is not a diagnostic step and bucket policies cannot grant access to security groups.

Answer

Use the AWS CLI command 'aws sts assume-role' to test the role credentials.

Answer

Modify the S3 bucket policy to grant access to the instance's security group.

Question 7

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to download an object from my-bucket that was uploaded without server-side encryption. What happens?

Accepted Answer

The request is denied because the object is not encrypted with SSE-KMS.. The IAM policy includes a condition that requires the request to include the `s3:x-amz-server-side-encryption` header set to `aws:kms`. For GetObject, this header is not part of the request, so the condition always fails and the request is denied. Option A is incorrect because the policy does not allow GetObject without satisfying the condition. Option C is incorrect because the policy is an IAM policy, not a bucket policy. Option D is incorrect because even though the policy allows the s3:GetObject action, the condition is not satisfied, so the request is denied.

Answer

The request succeeds because the condition only applies to PutObject.

Answer

The request is denied because the bucket policy requires encryption.

Answer

The request succeeds because the policy allows s3:GetObject.

Question 8

Refer to the exhibit. A developer in account 111111111111 tries to assume a role in account 123456789012. The error occurs. What is the MOST likely cause?

Accepted Answer

The user does not have sts:AssumeRole permission on the target role.. Cross-account role assumption requires a trust policy and an IAM policy granting sts:AssumeRole. Without the actual error shown in the exhibit, the cause cannot be definitively determined. An incorrect role ARN also often results in AccessDenied, not NoSuchEntity, so option D cannot be ruled out based solely on the error type.

Answer

The role does not exist in the us-east-1 region.

Answer

The access keys used are expired.

Answer

The role ARN is incorrect.

Question 9

A company wants to ensure that all data in transit between a web application and its users is encrypted. Which AWS service can provide SSL/TLS termination?

Accepted Answer

Application Load Balancer (ALB). Application Load Balancer (ALB). ALB can terminate SSL/TLS, decrypt traffic, and forward it to backend targets. Option A (Amazon CloudFront) also provides SSL termination, but the question asks for a service that can provide SSL/TLS termination within a VPC, making ALB the typical choice. Option C (Amazon Route 53) is a DNS service and does not terminate SSL. Option D (Amazon EC2 instance) can handle SSL termination if configured, but it is not a managed service; the question asks for an AWS service, so EC2 is not the best answer.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

Amazon EC2 instance

Question 10

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The instance has an IAM role with an attached policy that allows s3:GetObject on the bucket. However, the application is receiving Access Denied errors. What is a likely cause?

Accepted Answer

The bucket policy has an explicit deny that overrides the IAM allow.. If the bucket policy explicitly denies access, the deny overrides any allow from IAM. Option A is wrong because S3 does not require S3 Block Public Access for IAM role access. Option B is wrong because the instance profile needs an IAM role, not an IAM user. Option D is wrong because S3 does not require the s3:ListBucket permission to get an object if you know the key.

Answer

The IAM role does not have s3:ListBucket permission.

Answer

The EC2 instance is not associated with an instance profile.

Answer

The bucket has S3 Block Public Access enabled.

Question 11

A company is using AWS KMS to encrypt data in S3. They want to ensure that only specific IAM roles can decrypt the data, even if the IAM role has full S3 access. What should they do?

Accepted Answer

Modify the KMS key policy to grant decrypt permission only to the specific IAM role.. The KMS key policy is the primary access control mechanism for a KMS key, and it must explicitly grant decrypt permission to the IAM role. Even if an IAM role has full S3 access, it cannot decrypt data encrypted with a KMS key unless the key policy allows it (or the key policy delegates to IAM). Therefore, modifying the key policy to grant kms:Decrypt only to the specific role is the correct approach.

Answer

Use an IAM policy to deny KMS Decrypt for all users except the role.

Answer

Add a bucket policy that denies Decrypt for all principals except the role.

Answer

Enable S3 Block Public Access on the bucket.

Question 12

A developer is building an application that uploads files to S3. The application uses an IAM user with access keys. The developer wants to rotate the access keys regularly. Which approach is the most secure?

Accepted Answer

Use AWS Secrets Manager to automatically rotate the access keys.. AWS Secrets Manager natively supports automatic rotation of IAM access keys through a Lambda rotation function, eliminating long-lived credentials and manual rotation overhead. This is the most secure approach because it enforces regular rotation without human intervention and integrates with IAM to create and delete keys programmatically.

Answer

Use the root account access keys and rotate them manually.

Answer

Manually create new keys every 90 days and update the application.

Answer

Create a new IAM user and update the application.

Question 13

A developer is designing a microservices architecture where each service communicates over HTTPS. They need to ensure that only authorized services can invoke each other. Which TWO services can be used to manage authentication and authorization between services?

Accepted Answer

AWS App Mesh. The correct answers are AWS App Mesh and AWS VPC Lattice. App Mesh provides mutual TLS (mTLS) for service-to-service authentication, while VPC Lattice includes IAM-based authentication and authorization for service-to-service traffic. Amazon API Gateway is typically used for external API access and can enforce auth, but it is not primarily a service-to-service communication/auth service. AWS Resource Access Manager is for sharing resources across accounts, and AWS Direct Connect is a network connection service, neither provides service authentication.

Answer

AWS Resource Access Manager

Answer

AWS Direct Connect

Answer

Amazon API Gateway

Question 14

A company wants to ensure that only encrypted connections are used to access their S3 bucket. Which THREE methods can be used to enforce this?

Accepted Answer

Use Amazon CloudFront with the S3 bucket as origin and require HTTPS.. To enforce encrypted connections to S3, you can use a bucket policy denying aws:SecureTransport=false (D) or configure CloudFront with HTTPS and restrict S3 access to CloudFront (A). Option E encrypts objects but does not require TLS for the connection itself. Options B and C are unrelated to encryption in transit.

Answer

Enable default encryption on the bucket.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Use client-side encryption for all uploads.

Question 15

Refer to the exhibit. An IAM role has the attached policy. A developer is writing an application that will upload objects to the S3 bucket using server-side encryption with AWS KMS (SSE-KMS). The application is failing with an Access Denied error when trying to upload. What is the missing permission?

Accepted Answer

kms:Decrypt on the KMS key. The missing permission is kms:Decrypt on the KMS key. Although SSE-KMS requires kms:GenerateDataKey for encryption during upload, certain scenarios (e.g., when the KMS key has already been used in the same region or when the bucket policy includes conditional checks) may require kms:Decrypt to verify key access. The current policy allows kms:GenerateDataKey but lacks kms:Decrypt, causing Access Denied errors for the upload. Option A is correct. Option B (kms:ListKeys) is not required. Option C (kms:Encrypt) is not used by S3 for SSE-KMS. Option D (s3:PutObjectAcl) is not needed for basic uploads.

Answer

kms:ListKeys on the KMS key

Answer

kms:Encrypt on the KMS key

Answer

s3:PutObjectAcl on the bucket