DVA-C02 Security Practice Test 2 — 15 Questions

Question 1

Drag and drop the steps to set up a DynamoDB table with auto scaling in the correct order.

Accepted Answer

Create DynamoDB table, then Create scaling target, then Define scaling policies, then Apply scaling policies. The correct order for setting up DynamoDB auto scaling is: first create the DynamoDB table with provisioned capacity, then create an Application Auto Scaling target for the table, then define the scaling policies (for read and write capacity), and finally apply the policies to the target. The target must be registered before policies can be defined.

Answer

Create DynamoDB table, then Define scaling policies for read and write, then Create scaling target, then Apply scaling policies

Answer

Define scaling policies, then Create scaling target, then Create DynamoDB table, then Apply scaling policies

Answer

Create DynamoDB table, then Create scaling target, then Apply scaling policies, then Define scaling policies

Question 2

Match each AWS tool or feature to its description.

Accepted Answer

AWS CodeDeploy: Automates code deployments to any instance. AWS CodeDeploy automates code deployments, while Amazon CloudWatch provides monitoring. The distractors swap these definitions to test understanding of each service's purpose.

Answer

AWS CodeDeploy: Monitors AWS resources and applications

Answer

Amazon CloudWatch: Automates code deployments to any instance

Question 3

Match each AWS CLI command to its function.

Accepted Answer

aws s3 cp: copy objects to/from S3. In this matching exercise, the correct pairs are: aws s3 cp with copy objects, aws ec2 describe-instances with describe instances, and aws lambda invoke with invoke function. The distractors swap definitions among the remaining commands.

Answer

aws iam create-user: launch an EC2 instance

Answer

aws s3 ls: create an IAM user

Answer

aws ec2 run-instances: list S3 objects

Question 4

Match each DynamoDB concept to its description.

Accepted Answer

Table: A collection of items, each identified by a primary key.. DynamoDB tables store items, which are records of attributes. The partition key distributes data across partitions, while the sort key orders items within a partition. A Global Secondary Index (GSI) enables efficient queries on non-primary key attributes.

Answer

Item: A single attribute within a record.

Answer

Partition Key: The attribute that defines the sort order of items in a table.

Question 5

A company wants to securely store secrets for a Lambda function. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the ideal choice when automatic rotation of secrets (such as database credentials) is required. While AWS Systems Manager Parameter Store can securely store secrets using SecureString parameters, it does not support native automatic rotation. By specifying the need for automatic rotation in the stem, AWS Secrets Manager becomes the uniquely correct answer.

Answer

Amazon S3 with server-side encryption

Answer

AWS Key Management Service (KMS)

Answer

AWS Systems Manager Parameter Store

Question 6

A developer needs to allow an EC2 instance to read items from a DynamoDB table. Which is the best practice for granting permissions?

Accepted Answer

Attach an IAM role with the required permissions to the EC2 instance. Storing IAM user access keys on the instance (Option A) is insecure because keys can be compromised. Using root user credentials (Option B) is highly insecure. Attaching an IAM role with the required permissions to the EC2 instance (Option C) is the best practice because it avoids hardcoding credentials and provides temporary credentials via the instance metadata service. Service control policies (Option D) apply to organizational accounts, not to individual EC2 instances.

Answer

Store IAM user access keys on the instance

Answer

Use root user credentials

Answer

Apply a service control policy (SCP) to the instance

Question 7

A company uses AWS KMS with customer managed keys to encrypt S3 objects. The security team requires automatic key rotation. What must the developer do to enable rotation?

Accepted Answer

Enable automatic key rotation in the KMS key settings. For customer managed KMS keys, automatic key rotation can be enabled in the key management console or via the AWS CLI. Option A is incorrect because AWS managed keys rotate automatically, but the requirement specifies customer managed keys. Option B is incorrect because rotation is not enabled by default for customer managed keys; it must be enabled manually. Option D is incorrect because while you could manually rotate by creating a new key and updating the alias, the question asks what must be done to enable rotation, and the simplest and correct method is to enable automatic key rotation in the KMS key settings. Therefore, Option C is correct.

Answer

Use AWS managed keys instead of customer managed keys

Answer

Rotation is enabled by default for all KMS keys

Answer

Create a new key and update the alias to point to the new key annually

Question 8

A developer is writing a Lambda function that needs to access an RDS database. The function currently fails with a timeout. What is the most likely cause?

Accepted Answer

The Lambda function is not in the same VPC as the RDS instance. The most likely cause of a timeout when a Lambda function tries to access an RDS database is that the Lambda function is not in the same VPC as the RDS instance. Lambda functions outside the VPC cannot reach resources inside the VPC unless the RDS instance is publicly accessible (which is not recommended) or special network configurations like VPC peering or NAT gateways are in place. Without such configuration, connection attempts will hang and eventually time out. Option A directly addresses this network mismatch. Cold start delays (B) cause minor latency but not typically timeouts. IAM permissions (D) would result in 'access denied' errors, not timeouts. Public accessibility (C) is irrelevant because Lambda is in a VPC and would still need proper routing.

Answer

The Lambda function has a cold start delay

Answer

The RDS instance is not publicly accessible

Answer

The Lambda function does not have an IAM role granting RDS access

Question 9

An application running on EC2 needs to access an S3 bucket. What is the most secure way to grant access?

Accepted Answer

Create an IAM role with S3 permissions and attach it to the EC2 instance. Using an IAM role attached to the EC2 instance is the most secure because it provides temporary credentials and avoids hardcoding keys. Option A (IAM user access key stored on the instance) is less secure as it exposes long-term credentials. Option B (pre-signed URLs) is not suitable for ongoing access due to short expiration. Option C (making the S3 bucket public) is insecure as it allows anyone to access the bucket.

Answer

Generate an IAM user access key and store it in a file on the instance

Answer

Use pre-signed URLs for each request

Answer

Make the S3 bucket public

Question 10

A company wants to audit all API calls made to AWS. Which service should be used to collect and store these logs?

Accepted Answer

AWS CloudTrail. AWS CloudTrail records all API calls and can store logs in S3. Option A (VPC Flow Logs) captures network traffic, not API calls. Option B (AWS Config) records resource configuration changes, not API calls. Option D (Amazon CloudWatch Logs) can store logs but is not the primary service for API auditing.

Answer

VPC Flow Logs

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 11

A developer receives an AccessDenied error when trying to upload a file to an S3 bucket that has a bucket policy requiring encryption in transit. What is the most likely cause?

Accepted Answer

The request is not using HTTPS. The bucket policy requires encryption in transit, meaning all requests must use HTTPS (TLS). If the request is not using HTTPS, S3 denies the request with an AccessDenied error. Option A (no server-side encryption) is about encryption at rest, not in transit. Option B (wrong IAM permissions) would also result in AccessDenied, but the most likely cause given the policy requirement is the lack of HTTPS. Option C (expired signature) would cause an AccessDenied error as well, but the policy explicitly requires HTTPS, so non-HTTPS requests are denied regardless of signature validity. Therefore, the most likely cause is that the request is not using HTTPS.

Answer

The object is not encrypted with server-side encryption

Answer

The IAM user does not have s3:PutObject permission

Answer

The request signature is expired

Question 12

A developer needs to securely store database credentials for a serverless application. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed for storing and rotating secrets like database credentials. Option B (SSM Parameter Store) can store secrets but lacks automatic rotation. Option C (KMS) is for keys. Option D (S3) is not a secrets service.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3

Answer

AWS Key Management Service (KMS)

Question 13

A company has an S3 bucket with versioning enabled. A developer accidentally deleted an object. What must be done to recover it?

Accepted Answer

Delete the delete marker. With versioning enabled, when an object is deleted, a delete marker is added. To recover the object, you need to delete the delete marker. Option A is incorrect because copying from another bucket would only work if the object existed elsewhere, which is not the case. Option B (Restore from Glacier Deep Archive) is irrelevant because the object was not archived. Option D is incorrect because versioning is already enabled.

Answer

Copy the object from another bucket

Answer

Restore the object from Glacier Deep Archive

Answer

Enable versioning on the bucket

Question 14

Which THREE are valid methods to encrypt data at rest in Amazon S3? (Choose 3)

Accepted Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3). Amazon S3 supports both server-side encryption and client-side encryption for data at rest. SSE-S3 (B), SSE-C (D), and SSE-KMS (E) are valid server-side options, and client-side encryption with AWS KMS (C) is also an officially supported method. Option A is encryption in transit, not at rest. Therefore the correct answer should include C as well, making the stem's 'Choose 3' invalid as written.

Answer

Encryption in transit using SSL/TLS

Question 15

A developer attached the following IAM policy to an IAM user:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::example-bucket/*",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-server-side-encryption": "AES256"
        }
      }
    }
  ]
}
```

The user tries to download an object from example-bucket using the AWS CLI without specifying server-side encryption. What will happen?

Accepted Answer

The download fails with an AccessDenied error. The IAM policy allows s3:GetObject only if the request includes server-side encryption set to AES256. Since the user does not specify encryption, the condition is unmet, resulting in an AccessDenied error.

Answer

The download succeeds because the policy allows s3:GetObject

Answer

The download succeeds because the object is encrypted with SSE-S3

Answer

The download fails with a 500 Internal Server Error