DVA-C02 Security Practice Test 22 — 15 Questions

Question 1

Which THREE are best practices for managing IAM users and roles? (Choose three.)

Accepted Answer

Rotate IAM user access keys periodically.. Options A, B, and C are correct. Option A: Rotating IAM user access keys periodically reduces the risk of compromised credentials. Option B: Granting least privilege ensures users have only the permissions necessary to perform their tasks, minimizing security risks. Option C: Using IAM roles for EC2 instances avoids the need to store long-term access keys on the instances, which is more secure. Option D is incorrect because the root account should not be used for daily tasks; it should be secured and used only for account-level administrative actions. Option E is incorrect because assigning full administrator access violates the principle of least privilege and increases security risk.

Answer

Use the root account for daily administrative tasks.

Answer

Assign full administrator access to all users.

Question 2

A company wants to give a third-party auditor read-only access to their AWS account for compliance purposes. What is the most appropriate way to grant this access?

Accepted Answer

Create an IAM role with the SecurityAudit managed policy and allow the auditor to assume it.. An IAM role with the SecurityAudit managed policy provides read-only access to security-related services, allowing the third-party auditor to assume the role and obtain temporary credentials. This follows the principle of least privilege and avoids sharing long-term access keys or root credentials. Option A is wrong because AdministratorAccess grants full administrative privileges, not read-only. Option C is wrong because a policy allowing all actions also provides full access, not read-only. Option D is wrong because sharing root account credentials is a severe security risk and violates AWS best practices.

Answer

Attach the AdministratorAccess managed policy to an IAM user.

Answer

Create an IAM user with a custom policy that allows all actions.

Answer

Share the root account credentials with the auditor.

Question 3

A developer is using AWS Lambda to process sensitive data. The Lambda function needs to access a DynamoDB table that is encrypted with a customer-managed CMK. The developer is using the default Lambda execution role. What must be done to allow Lambda to decrypt the DynamoDB table?

Accepted Answer

Add a policy to the KMS key that allows the Lambda execution role to perform kms:Decrypt.. The DynamoDB table is encrypted with a customer-managed CMK. The Lambda execution role must be granted permission to use that key. This is done by adding a statement to the KMS key's key policy that allows the Lambda execution role to perform kms:Decrypt. DynamoDB will then perform the decryption on behalf of Lambda. Option A is incorrect because dynamodb:GetItem alone does not grant KMS decrypt permissions. Option C is incorrect because a VPC endpoint is not related to KMS permissions. Option D is incorrect because Lambda does not need to directly call the KMS Decrypt API; the key policy handles the authorization.

Answer

Add a policy to the Lambda execution role allowing dynamodb:GetItem.

Answer

Configure a VPC endpoint for DynamoDB.

Answer

Modify the Lambda function to call KMS Decrypt API.

Question 4

A developer is storing secrets such as database passwords. Which TWO AWS services can be used to securely store and retrieve secrets?

Accepted Answer

AWS Systems Manager Parameter Store. And Option D are correct. AWS Secrets Manager is designed for secrets with automatic rotation. AWS Systems Manager Parameter Store can store secrets in the Advanced tier with encryption. IAM is for identities. S3 is object storage. CloudHSM is a hardware security module.

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon S3

Question 5

A developer wants to ensure that an S3 bucket is not publicly accessible. Which TWO measures should the developer implement?

Accepted Answer

Review the bucket policy to ensure it does not allow public access.. To prevent public access to an S3 bucket, two effective measures are: (1) reviewing the bucket policy (D) to ensure no statements grant public access, and (2) enabling S3 Block Public Access settings (E) which override any policies or ACLs that allow public access. Option A (server access logging) is for auditing access, not controlling it. Option B (versioning) is for preserving object versions. Option C (default encryption) protects data at rest, not access control.

Answer

Enable S3 server access logging.

Answer

Enable versioning on the bucket.

Answer

Enable default encryption on the bucket.

Question 6

Which TWO actions are recommended to secure an S3 bucket? (Choose 2)

Accepted Answer

Block public access at the bucket level. Options A and D are correct. A: Block public access is a key security measure. D: Enable default encryption ensures data at rest is encrypted. B: Disabling versioning reduces data protection and is not recommended for security. C: Using HTTP instead of HTTPS is insecure. E: Granting public read access via ACLs is insecure and should be avoided.

Answer

Disable versioning to reduce complexity

Answer

Use HTTP instead of HTTPS for faster access

Answer

Grant public read access via ACLs

Question 7

Which THREE are valid methods to authenticate to AWS APIs? (Choose 3)

Accepted Answer

Temporary security credentials from AWS STS. The three valid methods to authenticate to AWS APIs are: A - Temporary security credentials from AWS STS, C - Credentials from an EC2 instance profile, and E - IAM user access key ID and secret access key. Option B (database password stored in Secrets Manager) is not used for API authentication; Secrets Manager stores secrets but does not provide AWS API credentials. Option D (CloudFront key pair) is used for signed URLs and signed cookies, not for general AWS API authentication.

Answer

Database password stored in Secrets Manager

Answer

CloudFront key pair

Question 8

Which TWO are features of AWS Identity and Access Management (IAM)? (Choose 2)

Accepted Answer

Define fine-grained permissions with policies. Options C and E are correct. IAM allows you to define fine-grained permissions using policies (C) and create and manage users and groups (E). Option A is incorrect because encrypting S3 objects is a feature of S3, not IAM. Option B is incorrect because monitoring network traffic is typically done by VPC flow logs or CloudTrail, not IAM. Option D is incorrect because managing EC2 instance lifecycle is an EC2 function, not IAM.

Answer

Encrypt S3 objects automatically

Answer

Monitor network traffic

Answer

Manage EC2 instance lifecycle

Question 9

A developer is using an S3 bucket to store sensitive files. The bucket policy includes a condition that requires TLS for all requests. A user reports that they can access the bucket via the AWS Management Console but not via an application using HTTP. What is the likely issue?

Accepted Answer

The bucket policy denies HTTP requests via aws:SecureTransport condition.. The condition aws:SecureTransport requires HTTPS; the application uses HTTP, which violates the policy.

Answer

The application is using an expired IAM access key.

Answer

The S3 bucket is in a different region.

Answer

The application is not signing requests with Signature Version 4.

Question 10

A developer wants to encrypt data in an S3 bucket using server-side encryption with AWS KMS (SSE-KMS). Which TWO steps are required?

Accepted Answer

Set the default encryption on the bucket to SSE-KMS.. The bucket must be configured for SSE-KMS, and the IAM role must have kms:GenerateDataKey and kms:Decrypt permissions.

Answer

Enable MFA Delete on the bucket.

Answer

Create a bucket policy that denies unencrypted requests.

Answer

Enable versioning on the bucket.

Question 11

A company has an IAM policy that allows s3:GetObject for all users in the account. However, a specific user is receiving access denied errors. Which THREE possible causes should the developer investigate?

Accepted Answer

An SCP at the organization level denies s3:GetObject.. The correct answers are A, C, and E. An organization-level SCP can deny s3:GetObject, overriding IAM allows. An explicit deny in the user's role policy also overrides any allow. A bucket policy with an explicit Deny statement will cause access denied even if IAM allows. Option B is incorrect because using a wrong region endpoint results in a different error (e.g., NoSuchBucket or redirect), not an access denied. Option D is incorrect because cross-account access is possible with proper permissions; the bucket being in another account does not inherently deny access.

Answer

The user is using an incorrect region endpoint.

Answer

The S3 bucket is in a different AWS account.

Question 12

A developer is tasked with securing a legacy application that stores secrets in environment variables. Which THREE AWS services can be used to improve the security posture?

Accepted Answer

AWS Key Management Service (KMS). Secrets Manager, Parameter Store, and KMS can all help manage and encrypt secrets.

Answer

AWS Certificate Manager

Answer

AWS CloudHSM

Question 13

A developer attaches the following IAM policy:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "ec2:RunInstances",
      "Resource": "*"
    },
    {
      "Effect": "Deny",
      "Action": "ec2:RunInstances",
      "Resource": "*",
      "Condition": {
        "StringNotEquals": {
          "ec2:InstanceType": "t2.micro"
        }
      }
    }
  ]
}
```

What happens when the developer attempts to launch a t2.micro instance?

Accepted Answer

The action is allowed because the Allow statement applies and the Deny condition excludes t2.micro.. The question implies an IAM policy with an Allow statement for ec2:RunInstances and a Deny statement that uses a condition (e.g., ec2:InstanceType StringNotEquals t2.micro) to block instances that are not t2.micro. Since the condition in the Deny only matches non-t2.micro instances, the Deny does not apply to t2.micro. Therefore, the Allow takes effect and launching a t2.micro instance is allowed.

Answer

The action is denied because ec2:RunInstances requires additional permissions.

Answer

The action is denied because the Deny statement overrides the Allow.

Answer

The action is allowed only if the user has ec2:DescribeInstances as well.

Question 14

A developer needs to encrypt data at rest in an Amazon S3 bucket. Which THREE options are available for server-side encryption?

Accepted Answer

SSE-C. S3 offers three server-side encryption options: SSE-S3 (using S3-managed keys), SSE-KMS (using AWS KMS), and SSE-C (using customer-provided keys).

Answer

Client-side encryption

Answer

AWS CloudHSM

Question 15

A company is deploying a web application on EC2 instances behind an ALB. The application needs to authenticate users using a corporate identity provider that supports SAML 2.0. Which of the following are required to configure this? (Choose THREE.)

Accepted Answer

Obtain the IdP's metadata document to configure the trust.. Options A, B, and E are correct. To enable SAML authentication on an ALB, you need the IdP's metadata to establish trust (A), register the IdP in IAM as a SAML identity provider (B), and configure an ALB listener rule that uses that provider for authentication (E). Option C is incorrect because Amazon Cognito is not required; the ALB can directly authenticate against the SAML IdP. Option D is incorrect because Route 53 is a DNS service and is not involved in SAML authentication.

Answer

Configure Amazon Cognito as an intermediary.

Answer

Register the corporate IdP in Amazon Route 53.