DVA-C02 Security Practice Test 20 — 15 Questions

Question 1

A developer is managing an application that uses Amazon S3 to store user-uploaded images. The application generates thumbnails using AWS Lambda and stores them in a separate S3 bucket. The security team requires that all objects in both buckets be encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). The developer has configured the Lambda function to use an IAM role with permissions to call KMS Encrypt and Decrypt. However, when a user uploads an image, the Lambda function fails to write the thumbnail with an 'Access Denied' error. The upload bucket has default encryption set to SSE-KMS. What is the MOST likely cause of the failure?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The Lambda execution role lacks kms:GenerateDataKey permission for the KMS key.. SSE-KMS encryption requires the caller to have both kms:Encrypt and kms:GenerateDataKey permissions on the KMS key. The Lambda execution role was granted Encrypt and Decrypt but not GenerateDataKey, so when S3 attempts to encrypt the thumbnail using SSE-KMS, the KMS call fails and S3 returns Access Denied. Adding kms:GenerateDataKey (and typically kms:Decrypt for reads) resolves the issue.

Answer

The Lambda function is not in a VPC that has access to the KMS key.

Answer

The output bucket does not have a bucket policy allowing the Lambda function to write.

Answer

The upload bucket's default encryption is not applied to objects uploaded by Lambda.

Question 2

A developer needs to share an S3 bucket with a third-party AWS account. The third-party will upload files to the bucket using their own IAM users. The developer creates a bucket policy that grants s3:PutObject to the third-party account's root user. However, the third-party reports that their IAM users cannot upload files. What is the MOST likely reason?

Accepted Answer

The third-party's IAM users do not have an IAM policy allowing s3:PutObject.. For cross-account access to S3, both the resource-based policy (bucket policy) and the identity-based policy (IAM policy attached to the third-party's IAM users) must grant the required permission. The bucket policy correctly grants s3:PutObject to the third-party account, but the third-party's IAM users also need an IAM policy allowing s3:PutObject. Without that identity-based permission, the request is denied even though the bucket policy allows it.

Answer

The bucket policy must include a condition requiring encryption.

Answer

The bucket policy should grant access to the IAM user ARN instead of the root user.

Answer

The developer must create IAM users in their own account for the third-party.

Question 3

A developer is deploying a serverless application using AWS Lambda and API Gateway. The application needs to authenticate users via a third-party OIDC provider. The developer wants to minimize latency and avoid managing sessions. What is the BEST approach to achieve this?

Accepted Answer

Use Amazon Cognito User Pools with the OIDC identity provider and integrate with API Gateway.. Amazon Cognito User Pools natively support OIDC identity providers as federated IdPs, and API Gateway can use a Cognito User Pool authorizer to validate the resulting JWT tokens at the edge with minimal latency and no session management. This offloads authentication to a managed service, satisfying the requirements for third-party OIDC auth, low latency, and statelessness.

Answer

Use Lambda@Edge to validate tokens at CloudFront edge locations.

Answer

Use Amazon Cognito Identity Pools with the OIDC provider.

Answer

Implement a custom Lambda authorizer in API Gateway to validate tokens.

Question 4

A developer is building a web application that stores user session data in an ElastiCache Redis cluster. The cluster is in a VPC and is not publicly accessible. The developer needs to ensure that data in transit is encrypted. What should the developer do?

Accepted Answer

Enable encryption in transit on the ElastiCache Redis cluster.. ElastiCache for Redis supports encryption in transit, which encrypts data between the client and the Redis cluster. Placing an Application Load Balancer in front of the Redis cluster (Option B) is not supported; Redis uses a custom protocol that ALB cannot handle. Configuring security groups (Option C) controls network traffic but does not encrypt data. VPC peering (Option D) allows network connectivity but does not provide encryption in transit.

Answer

Place an Application Load Balancer in front of the Redis cluster and enable TLS termination.

Answer

Configure the security group to only allow traffic from the application servers.

Answer

Use VPC peering to connect the application VPC to the ElastiCache VPC.

Question 5

A company has a DynamoDB table that stores personally identifiable information (PII). A developer needs to allow a Lambda function to read and write to this table. What is the MOST secure way to grant the Lambda function access?

Accepted Answer

Create an IAM role with a policy that allows DynamoDB read/write access and attach it to the Lambda function.. Attaching an IAM role with a least-privilege policy to the Lambda function is the AWS-recommended, most secure approach. Lambda assumes the execution role automatically at invocation, and no long-lived credentials are stored anywhere. This eliminates credential leakage risk and follows the principle of least privilege.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function's IAM role.

Answer

Create an IAM user with programmatic access and embed the credentials in the Lambda environment variables.

Answer

Have the Lambda function assume a role using AWS STS each time it runs.

Question 6

A developer is creating a new IAM policy to allow users to list objects in a specific S3 bucket. The policy must follow the principle of least privilege. Which policy statement should the developer use?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}. The s3:ListBucket action controls the ability to list the objects within a specific bucket, and it must be granted on the bucket resource itself (arn:aws:s3:::example-bucket), not on the objects inside it. Option B correctly pairs the least-privilege action with the correct resource ARN, allowing the user to list objects in only that one bucket. This satisfies the principle of least privilege because it grants no access to other buckets and no object-level read/write permissions.

Answer

{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::example-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}

Question 7

A developer is deploying an application on Amazon ECS with Fargate. The application needs to access an S3 bucket that contains sensitive data. The developer wants to avoid storing AWS credentials in the container image. What is the MOST secure way to grant the application access to the S3 bucket?

Accepted Answer

Create an IAM task role with a policy that allows S3 access and specify it in the task definition.. An IAM task role for ECS tasks allows the container to assume the role without storing credentials. Option B is wrong because environment variables are not secure. Option C is wrong because mounting credentials in a volume is insecure. Option D is wrong because IAM instance profiles are for EC2 instances, not Fargate tasks.

Answer

Set the AWS credentials as environment variables in the task definition.

Answer

Store the credentials in an EFS volume and mount it to the container.

Answer

Use an IAM instance profile attached to the underlying EC2 instance.

Question 8

A developer needs to allow a user to deploy AWS CloudFormation stacks but restrict the user from creating or modifying IAM resources. Which IAM policy should the developer attach to the user?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"cloudformation:*","Resource":"*"},{"Effect":"Deny","Action":"iam:*","Resource":"*"}]}. It grants full access to CloudFormation actions via an Allow statement while explicitly denying all IAM actions via a Deny statement, ensuring the user can deploy stacks but cannot create or modify IAM resources. Option B is incorrect because it allows all IAM actions, granting excessive permissions. Option C is incorrect because it allows CloudFormation but does not explicitly deny IAM, which could permit IAM actions if other policies allow. Option D is incorrect because it denies all CloudFormation actions, preventing stack deployment.

Answer

{"Effect":"Allow","Action":"iam:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"cloudformation:*","Resource":"*"}

Answer

{"Effect":"Deny","Action":"cloudformation:*","Resource":"*"}

Question 9

A company has an S3 bucket that stores log files. The bucket policy grants the AWSServiceRoleForSSO service role write access. However, the logs are not being written. What is the MOST likely reason?

Accepted Answer

The bucket policy uses a service role ARN that is not a valid principal for S3 bucket policies.. The bucket policy uses the ARN of the AWSServiceRoleForSSO service-linked role as the principal, but S3 bucket policies do not accept service role ARNs as valid principals. Instead, you must use the AWS service principal (e.g., sso.amazonaws.com) when granting permissions to an AWS service that uses a service role. Therefore, the policy fails to grant write access. Options A, C, and D are incorrect: S3 Block Public Access settings only block public access, not access from service roles; bucket ACLs are not effective when a bucket policy exists and private ACLs do not prevent authorized writes; default encryption with SSE-S3 does not block writes from any principal.

Answer

The bucket has S3 Block Public Access enabled, which blocks all service role access.

Answer

The bucket ACL is set to private, which prevents service role writes.

Answer

The bucket has default encryption enabled using SSE-S3, which prevents writes from service roles.

Question 10

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which of the following are true about RDS encryption? (Select THREE.)

Accepted Answer

Encryption at rest can be enabled when you create the DB instance.. Option B is correct because RDS encryption at rest is configured at creation time: when you launch the DB instance you select an AWS KMS customer master key (CMK), and RDS uses it to encrypt the underlying storage, logs, and snapshots. Option C is correct because any DB snapshot taken from an encrypted instance is automatically encrypted with the same KMS key, so copies and restores of that snapshot remain encrypted. Option D is correct because automated backups of an encrypted DB instance are encrypted with the same KMS key as the instance, as are manual snapshots and read replicas. Option A is not correct because you cannot enable encryption on an existing unencrypted instance in place; you must create an encrypted snapshot copy or restore into a new encrypted instance. Option E is not correct because a read replica of an encrypted instance must also be encrypted with the same KMS key; you cannot create an unencrypted read replica from an encrypted source.

Answer

Encryption at rest can be enabled on an existing unencrypted DB instance.

Answer

Read replicas of an encrypted instance can be unencrypted.

Question 11

A developer is configuring cross-account access for an S3 bucket. The source account (111111111111) wants to allow the target account (222222222222) to write objects to the bucket. The developer attaches the following bucket policy to the bucket in the source account:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::222222222222:root"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::example-bucket/*"
    }
  ]
}

However, the write operation fails with AccessDenied. What is the most likely cause?

Accepted Answer

The target account has not attached an IAM policy granting the user or role s3:PutObject. Cross-account S3 access requires both a bucket policy that grants the target account principal (or a resource-based policy) AND an IAM policy in the target account that explicitly allows the user or role to perform the s3:PutObject action. Without the target account's IAM policy, the request is denied even if the bucket policy permits it, as the target account's principal lacks the necessary permissions to make the call.

Answer

The bucket has an S3 ACL that denies the target account

Answer

The bucket policy does not allow s3:PutObject for the target account

Answer

The bucket is encrypted with SSE-KMS and the target account lacks KMS permissions

Question 12

A developer wants to securely store database credentials used by a Lambda function. The credentials should be automatically rotated every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials and other secrets. It supports native rotation with built-in integration for Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, MariaDB) and Amazon DocumentDB, allowing you to configure automatic rotation every 90 days without custom code. The service encrypts secrets at rest using AWS KMS and enforces fine-grained access control via IAM policies.

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Systems Manager Parameter Store

Question 13

A company has an S3 bucket that stores sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. Additionally, they want to enforce that objects are not uploaded without encryption. Which bucket policy should be used?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value aws:kms. It uses a Deny effect with a condition that checks for the presence and value of the `x-amz-server-side-encryption` header. This policy explicitly denies any `s3:PutObject` request that does NOT include `x-amz-server-side-encryption` with the value `aws:kms`, thereby enforcing server-side encryption with AWS KMS (SSE-KMS) on all uploads.

Answer

Deny s3:PutObject if the request includes x-amz-server-side-encryption

Answer

Allow s3:PutObject only if the request uses a specific KMS key

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value AES256

Question 14

A Lambda function needs to read from a DynamoDB table and send messages to an SQS queue. The function's IAM role should follow the principle of least privilege. Which policy statement should be attached to the role?

Accepted Answer

{"Effect":"Allow","Action":["dynamodb:GetItem"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}, {"Effect":"Allow","Action":["sqs:SendMessage"],"Resource":"arn:aws:sqs:us-east-1:123456789012:MyQueue"}. It grants only the specific DynamoDB read action (GetItem) needed to read from the table and the specific SQS write action (SendMessage) needed to send messages to the queue, scoped to the exact resource ARNs. This adheres to the principle of least privilege by not allowing any unnecessary operations or resources. Wrapping the statements in an array makes the policy snippet syntactically valid.

Answer

{"Effect":"Allow","Action":["dynamodb:*"],"Resource":"arn:aws:dynamodb:us-east-1:123456789012:table/MyTable"}

Answer

{"Effect":"Allow","Action":["dynamodb:GetItem","sqs:SendMessage","sqs:ReceiveMessage"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["dynamodb:GetItem","dynamodb:PutItem"],"Resource":"*"}

Question 15

A developer is using the AWS CLI to upload a file to an S3 bucket with server-side encryption. The bucket is configured with default encryption (SSE-S3). The developer wants to ensure the object is encrypted with SSE-KMS instead. What should the developer do?

Accepted Answer

Use the --sse aws:kms parameter when uploading. The developer must explicitly specify the server-side encryption method at the time of upload using the `--sse aws:kms` parameter in the AWS CLI. This overrides the bucket's default SSE-S3 encryption, ensuring the object is encrypted with SSE-KMS. Without this parameter, the object inherits the bucket's default encryption (SSE-S3), regardless of any other settings.

Answer

Use the --kms-key-id parameter with a KMS key ARN

Answer

No action needed; the bucket default encryption will apply

Answer

Change the bucket policy to require SSE-KMS