DVA-C02 Security Practice Test 20 — 15 Questions

Question 1

Given the IAM policy above, what is the effective permission for an IAM user?

Accepted Answer

Full access to the bucket except delete.. The IAM policy grants the user s3:GetObject and s3:ListBucket permissions, which allow reading objects and listing the bucket, but explicitly denies s3:DeleteObject. Since an explicit deny overrides any allow, the effective permission is full access except delete. Option D is correct because the user can perform all actions except deleting objects.

Answer

No access to the bucket.

Answer

Full access to the bucket including delete.

Answer

Read-only access to the bucket.

Question 2

Based on the CloudTrail log entry, which security concern should be investigated?

Accepted Answer

Multi-factor authentication (MFA) was not used when assuming the role.. The CloudTrail log entry shows that the `sts:AssumeRole` API call was made without the `aws:MultiFactorAuthPresent` key set to `true`. This indicates that the role was assumed without MFA, which violates the security best practice of requiring MFA for privileged role assumptions. The absence of MFA increases the risk of unauthorized access if the user's credentials are compromised.

Answer

The role used has too many permissions.

Answer

The instance was launched in an unauthorized region.

Answer

The source IP address is from a suspicious location.

Question 3

What is required for the Lambda function to access the code in the S3 bucket?

Accepted Answer

The Lambda execution role must have s3:GetObject permission on the S3 bucket.. Lambda functions access code stored in S3 buckets using an IAM execution role. The execution role must include the `s3:GetObject` permission for the specific bucket and object path to allow the Lambda service to download the deployment package. Without this permission, the Lambda function will fail with an access denied error during initialization.

Answer

The S3 bucket policy must grant access to the Lambda service.

Answer

The Lambda function must be in a VPC with an S3 VPC endpoint.

Answer

The S3 bucket must be configured as a static website with CloudFront.

Question 4

A developer is configuring an S3 bucket to host a static website. The bucket policy allows public read access. However, users receive a 403 Forbidden error when accessing the website. What is the most likely cause?

Accepted Answer

The bucket has 'Block all public access' settings enabled.. Option C is correct because the 'Block all public access' settings in the S3 bucket's Permissions tab override any bucket policy that grants public read access. Even if the bucket policy explicitly allows s3:GetObject for Principal "*", enabling any of the four block public access settings (especially 'Block public access to buckets and objects granted through new public bucket policies' or 'Block public and cross-account access to buckets and objects through any public bucket policies') will cause S3 to reject all anonymous requests, resulting in a 403 Forbidden error when accessing the static website endpoint.

Answer

The bucket is located in a different AWS region than the website endpoint.

Answer

The bucket name does not match the domain name.

Answer

The bucket is not configured with CloudFront as a content delivery network.

Question 5

A developer needs to grant a Lambda function read-only access to an S3 bucket. Which IAM entity should be used to attach the permissions?

Accepted Answer

Create an IAM role with the necessary permissions and assign it to the Lambda function as the execution role.. Option D is correct because Lambda functions require an IAM role (execution role) to obtain temporary AWS credentials via the AWS Security Token Service (STS). This role must have a trust policy allowing Lambda to assume it, and an attached permissions policy granting read-only access to the S3 bucket. This is the standard and secure method for granting permissions to an AWS service like Lambda.

Answer

Create an IAM user and provide the credentials to the Lambda function.

Answer

Attach a resource-based policy to the S3 bucket.

Answer

Attach a policy to an IAM group and add the Lambda function to the group.

Question 6

An application running on an EC2 instance needs to access a DynamoDB table. The instance is in a private subnet. What is the most secure way to grant access without using long-lived credentials?

Accepted Answer

Create an IAM role with DynamoDB access and attach it to the EC2 instance profile.. Option C is correct because it uses an IAM role attached to the EC2 instance profile, which allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS). This eliminates the need for long-lived credentials and follows the principle of least privilege. The instance can securely access DynamoDB without storing any secrets on the instance.

Answer

Create a VPC endpoint for DynamoDB and attach a security group to allow access.

Answer

Store IAM user access keys in the application configuration file.

Answer

Use a security group to allow the EC2 instance to communicate with DynamoDB.

Question 7

A company uses AWS KMS to encrypt S3 objects. A developer needs to allow an IAM user to decrypt objects but not encrypt them. Which IAM policy action should be allowed?

Accepted Answer

kms:Decrypt. The correct action is `kms:Decrypt` because the developer's requirement is to allow an IAM user to decrypt S3 objects but not encrypt them. AWS KMS uses separate permissions for encryption and decryption operations; `kms:Decrypt` specifically grants the ability to decrypt ciphertext without granting any encryption capabilities. By allowing only this action, the user can decrypt objects encrypted with the KMS key but cannot encrypt new data or perform any key management operations.

Answer

kms:GenerateDataKey

Answer

kms:Encrypt

Answer

kms:ReEncrypt

Question 8

A developer is using AWS Secrets Manager to rotate database credentials automatically. The rotation fails with the error 'The secret value is not valid JSON.' What is the most likely cause?

Accepted Answer

The secret value was stored as a plain string instead of a JSON object.. AWS Secrets Manager requires secret values to be stored as valid JSON objects when automatic rotation is configured. If the secret is stored as a plain string (e.g., a single password string without key-value pairs), the rotation function cannot parse it, resulting in the 'The secret value is not valid JSON' error. This is because the Lambda rotation function expects to read and write a JSON structure to manage the credentials during rotation.

Answer

The secret is in a different AWS region than the Lambda rotation function.

Answer

The secret name is not base64-encoded.

Answer

The secret does not have the correct version label.

Question 9

A developer needs to enforce encryption in transit for all traffic between an application and an RDS database. Which configuration should be used?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB parameter group.. Option D is correct because setting the 'require_secure_transport' parameter to 'ON' in the DB parameter group enforces TLS/SSL encryption for all connections to the RDS database. This ensures that data in transit between the application and the database is encrypted, meeting the requirement for encryption in transit.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Create a VPC peering connection between the application and database subnets.

Answer

Enable encryption at rest using AWS KMS.

Question 10

A developer has an IAM policy that allows 's3:GetObject' for a specific S3 bucket. However, when the developer tries to download an object using the AWS CLI, access is denied. What could be the issue?

Accepted Answer

The object is encrypted with SSE-KMS and the user lacks kms:Decrypt permission.. Option D is correct because when an S3 object is encrypted with SSE-KMS, the `s3:GetObject` permission alone is insufficient. The AWS CLI must also have `kms:Decrypt` permission on the KMS key used to encrypt the object. Without this, the S3 service cannot decrypt the object before returning it, resulting in an access denied error even though the S3 policy allows the GetObject action.

Answer

The bucket policy explicitly denies access to the user.

Answer

The bucket is in a different region than the CLI configuration.

Answer

The bucket ACL does not grant the user access.

Question 11

A developer wants to securely store API keys for a third-party service and retrieve them at runtime in a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and retrieving secrets such as API keys, database credentials, and OAuth tokens at runtime. It integrates natively with AWS Lambda via the AWS SDK, allowing developers to fetch secrets with minimal latency and without hardcoding sensitive values in code. Secrets Manager also supports automatic rotation of secrets using built-in or custom Lambda functions, which is critical for maintaining security compliance.

Answer

AWS CloudFormation

Answer

Amazon DynamoDB with encryption at rest

Answer

AWS Systems Manager Parameter Store

Question 12

A company's S3 bucket policy includes a condition that uses 'aws:SourceIp' to restrict access to a specific IP range. However, requests from that IP range are still denied. What is a possible reason?

Accepted Answer

The request is coming through a VPC endpoint, so the source IP is not the client's IP.. When a request is made through a VPC endpoint (specifically a Gateway Endpoint for S3), the source IP address seen by S3 is the private IP of the VPC endpoint, not the client's original public IP. The 'aws:SourceIp' condition key evaluates the IP address from which the request originates at the network layer, but VPC endpoints use private IPs from the VPC CIDR range, which will not match the public IP range specified in the policy. This causes the condition to fail and the request to be denied, even though the client is within the intended IP range.

Answer

The request is routed through CloudFront, which changes the source IP.

Answer

The bucket owner's IAM user policy overrides the bucket policy.

Answer

The condition key 'aws:SourceIp' is misspelled.

Question 13

A developer is designing a system that must meet PCI DSS compliance. Which THREE AWS services can help with logging and monitoring security events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it provides a centralized service for collecting, monitoring, and storing log data from various AWS resources and applications. For PCI DSS compliance, CloudWatch Logs can ingest security-related logs (e.g., from EC2, Lambda, or on-premises servers) and enable real-time monitoring, metric filters, and alarms to detect and respond to security events. It also supports log retention policies and encryption at rest using AWS KMS, which are required for audit trails under PCI DSS Requirement 10.

Answer

Amazon VPC Flow Logs

Answer

AWS Key Management Service (KMS)

Question 14

Which TWO actions should a developer take to securely manage database credentials in a serverless application?

Accepted Answer

Store credentials in AWS Secrets Manager and enable automatic rotation.. AWS Secrets Manager securely stores database credentials and supports automatic rotation, which reduces the risk of credential exposure and eliminates the need for manual updates. By integrating with Lambda via the AWS SDK, the application can retrieve credentials at runtime without embedding them in code or configuration files.

Answer

Store credentials in a text file within the Lambda deployment package.

Answer

Hardcode credentials in environment variables.

Answer

Use security groups to allow only the Lambda function to access the database.

Question 15

Which THREE practices help protect data at rest in Amazon S3?

Accepted Answer

Enable MFA Delete.. B is correct because enabling MFA Delete on an S3 bucket requires multi-factor authentication for permanent deletion of object versions, adding an extra layer of security to protect data at rest from accidental or malicious deletion. This directly safeguards the durability and integrity of stored data.

Answer

Enable versioning.

Answer

Enable cross-region replication.

DVA-C02 Security Practice Test 20 — 15 Questions

Exhibit

DVA-C02 Security Practice Test 20 — 15 Questions

Exhibit