DVA-C02 Security Practice Test 21 — 15 Questions

Question 1

A mobile application must let authenticated users upload only to their own S3 prefix. Which approach best follows least privilege?

Accepted Answer

Use Cognito identity credentials with an IAM policy scoped to the user's prefix using policy variables. It uses Amazon Cognito identity pools to issue temporary AWS credentials scoped to a specific S3 prefix via IAM policy variables (e.g., `${cognito-identity.amazonaws.com:sub}`). This ensures each authenticated user can only upload to their own prefix (e.g., `uploads/${user_id}/`), adhering to the principle of least privilege by granting no more access than necessary.

Answer

Use a single hardcoded access key in the app

Answer

Make the bucket public and validate names in the client

Answer

Give every user AmazonS3FullAccess

Question 2

An application receives webhooks from a partner. The developer must verify that each request was signed by the partner and not modified in transit. What should the application validate?

Accepted Answer

The HMAC or digital signature over the payload using the shared/public key material. Webhook verification relies on validating a cryptographic signature (HMAC or digital signature) computed over the request payload using a pre-shared secret or public key. This ensures the payload was signed by the partner and has not been tampered with during transit, as any modification would invalidate the signature. The application must recompute the HMAC or verify the digital signature using the partner's public key and compare it to the signature provided in the request header.

Answer

The source port number

Answer

The CloudWatch log stream name

Answer

The API Gateway request ID only

Question 3

A developer needs to call AWS APIs from application code running on EC2. Which credential source should the AWS SDK use by default?

Accepted Answer

Temporary credentials from the instance profile role. The AWS SDK on EC2 automatically retrieves temporary credentials from the instance metadata service (IMDS) at http://169.254.169.254/latest/meta-data/iam/security-credentials/. These credentials are provided by the IAM role attached to the EC2 instance (the instance profile role) and are rotated automatically, eliminating the need to store long-term credentials on the instance.

Answer

Static credentials committed to Git

Answer

A credentials file copied into the AMI

Answer

The root account access key

Question 4

An S3 bucket policy allows GetObject from another account, but objects encrypted with SSE-KMS still return AccessDenied. Which additional authorization is required?

Accepted Answer

The caller must be allowed to use the KMS key for decrypt operations. When an S3 object is encrypted with SSE-KMS, the S3 bucket policy granting GetObject access is not sufficient because S3 must also decrypt the object before returning it. The AWS KMS key policy must grant the caller kms:Decrypt permission, and the caller's IAM policy must also allow kms:Decrypt on the specific KMS key. Without this additional KMS authorization, S3 returns AccessDenied even if the bucket policy allows GetObject.

Answer

The caller must own the destination VPC

Answer

The bucket must enable static website hosting

Answer

The object key must end with .kms

Question 5

A developer needs to prevent accidental public access to all S3 buckets in an account. Which account-level control should be enabled?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is an account-level control that provides a centralized way to enforce that no S3 buckets or objects in the account can be made publicly accessible, regardless of individual bucket policies or ACLs. This setting overrides any bucket-level public access settings, effectively preventing accidental exposure of data to the internet.

Answer

S3 Transfer Acceleration

Answer

S3 Inventory

Answer

S3 Object Lambda

Question 6

A Lambda function in a VPC must retrieve secrets from Secrets Manager without traversing the public internet. Which configuration should be used?

Accepted Answer

An interface VPC endpoint for Secrets Manager with appropriate security groups. An interface VPC endpoint (AWS PrivateLink) for Secrets Manager allows Lambda functions within a VPC to securely retrieve secrets using private IP addresses, without traversing the public internet. This is achieved by creating an elastic network interface in the VPC subnet with a security group that controls access, ensuring traffic stays within the AWS network.

Answer

A public NAT gateway only

Answer

An internet gateway attached to the Lambda subnet

Answer

A VPC peering connection to every AWS region

Question 7

An application in ECS Fargate needs to read a secret and decrypt it with KMS. Which two permissions/configurations are needed?

Accepted Answer

Task role permissions for Secrets Manager access. The ECS task role is an IAM role that the Fargate task assumes to make AWS API calls. To read a secret from AWS Secrets Manager, the task role must have an IAM policy granting `secretsmanager:GetSecretValue` permission. Option D is correct because the secret is encrypted with a KMS key, so the task role also needs a KMS key policy or IAM permission that allows `kms:Decrypt` on that specific key.

Answer

Store the secret in the container image

Answer

An EC2 instance profile attached to the Fargate host

Question 8

A developer needs to securely distribute temporary AWS credentials to authenticated mobile users. Which two components are commonly involved?

Accepted Answer

Amazon Cognito identity pools. Amazon Cognito identity pools allow you to exchange identity tokens (from a user pool or external IdP) for temporary AWS credentials via the AWS Security Token Service (STS). These credentials are scoped to an IAM role with fine-grained permissions, enabling secure, least-privilege access to AWS resources from mobile apps without embedding long-term keys.

Answer

AWS root access keys

Answer

An unrestricted S3 bucket policy

Question 9

Which TWO are best practices for securing an AWS account? (Choose 2)

Accepted Answer

Enable multi-factor authentication (MFA) for privileged users. The best practices for securing an AWS account include enabling multi-factor authentication (MFA) for privileged users (Option D) and using IAM roles for applications that run on EC2 instances (Option E). Option A is incorrect because disabling CloudTrail reduces visibility into API activity, which is a security risk. Option B is incorrect because disabling password rotation weakens security posture. Option C is incorrect because the root user should be reserved for a limited set of tasks and not used daily.

Answer

Disable AWS CloudTrail to reduce costs

Answer

Disable password rotation to avoid user inconvenience

Answer

Use the root user for daily administrative tasks

Question 10

Which TWO actions are required to enable server-side encryption for an Amazon RDS instance? (Choose 2)

Accepted Answer

Use AWS KMS to manage the encryption key. To enable server-side encryption for an Amazon RDS instance, you must specify encryption at rest when creating the DB instance (Option E) and use AWS KMS to manage the encryption key (Option D). Encryption cannot be enabled after the instance is created (Option A is incorrect). Client-side encryption (Option B) is a separate approach that encrypts data before sending to RDS, not server-side encryption. Configuring a VPC (Option C) is unrelated to enabling encryption.

Answer

Enable encryption on the database after creation

Answer

Use client-side encryption in the application

Answer

Configure the DB instance to use a VPC

Question 11

A developer notices that an IAM user has permissions to terminate EC2 instances, but the user should only be allowed to stop instances. The developer needs to update the policy to prevent termination while allowing stop. Which IAM policy statement should be added?

Accepted Answer

{"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"}. A Deny statement explicitly blocks the specified action, overriding any Allow policies. Since the IAM user currently has permission to terminate EC2 instances (via an Allow policy), adding a Deny for ec2:TerminateInstances will prevent termination while still allowing the user to stop instances (if allowed by another policy). Option A provides this Deny. Option B is an Allow that would not block termination. Option C allows both stop and terminate. Option D is unrelated.

Answer

{"Effect":"Allow","Action":"ec2:TerminateInstances","Resource":"*"}

Answer

{"Effect":"Allow","Action":["ec2:StopInstances","ec2:TerminateInstances"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"ec2:RebootInstances","Resource":"*"}

Question 12

A developer is designing a system that must meet the following security requirements: (1) Encrypt data at rest in S3, (2) Automatically rotate encryption keys annually, (3) Use an encryption key that is managed by AWS. Which services or features should the developer use? (Choose TWO.)

Accepted Answer

SSE-KMS. The correct answers are B (SSE-KMS) and C (SSE-S3). SSE-KMS uses AWS KMS customer master keys (CMKs) which can be configured for automatic annual rotation via key rotation. SSE-S3 uses S3-managed keys that are automatically rotated by AWS. Both provide encryption at rest with keys managed by AWS. Option A (SSE-C) uses customer-provided keys, not AWS-managed. Option D (AWS CloudHSM) provides customer-managed hardware security modules. Option E (client-side encryption with AWS KMS) is client-side encryption, not server-side, and does not meet the requirement for AWS-managed key for S3.

Answer

SSE-C

Answer

AWS CloudHSM

Answer

Client-side encryption with AWS KMS

Question 13

Which TWO of the following are best practices for securing AWS account root user?

Accepted Answer

Delete the root user access keys.. Deleting root user access keys prevents unauthorized use via programmatic access. Option E is correct: Enabling MFA adds an extra layer of security. Option B is incorrect because the root user should not be used for daily tasks; use IAM users instead. Option C is incorrect because AWS does not automatically lock the root user after failed attempts. Option D is incorrect because sharing the root user password is a security risk.

Answer

Use the root user for daily administrative tasks.

Answer

Set a password policy that locks the root user after 10 failed attempts.

Answer

Share the root user password with senior developers for emergencies.

Question 14

A developer is using AWS Lambda and needs to ensure that the function can access an RDS database securely. Which THREE steps should be taken?

Accepted Answer

Place the Lambda function inside a VPC.. Options A, B, and E are correct. Option A: Placing the Lambda function inside a VPC allows it to communicate with the RDS database privately over the network. Option B: Storing database credentials in AWS Secrets Manager and retrieving them in the Lambda code is a secure practice, as it avoids hardcoding credentials and allows rotation. Option E: Configuring the security group of the RDS instance to allow inbound traffic from the Lambda function's security group ensures that only the Lambda function can connect. Option C is incorrect because granting rds:* permissions does not enable Lambda to authenticate to the database; IAM roles are for AWS API actions, not for database user authentication. Option D is incorrect because client certificates are not typically used for Lambda-to-RDS connections; authentication is done via database credentials.

Answer

Attach an IAM role to the Lambda function that grants rds:* permissions.

Answer

Configure the RDS instance to require client certificates.

Question 15

Which TWO actions can help protect an S3 bucket from data leaks? (Choose two.)

Accepted Answer

Enable default encryption.. Options B and D are correct. Enabling default encryption (B) ensures that all objects uploaded to the bucket are encrypted at rest, protecting data from unauthorized access if the bucket is misconfigured or accessed improperly. Blocking public access at the bucket level (D) prevents accidental public exposure of data. Option A (versioning) helps recover from accidental deletions or overwrites but does not prevent data leaks. Option C (MFA Delete) adds an extra authentication step for deleting objects or changing versioning, which protects against unauthorized deletions, not leaks. Option E (cross-region replication) provides data redundancy and disaster recovery, but does not prevent data leaks.

Answer

Enable versioning.

Answer

Enable MFA Delete.

Answer

Configure cross-region replication.