DVA-C02 Security Practice Test 22 — 15 Questions

Question 1

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The bucket policy allows s3:GetObject for the instance's IAM role, but the application is still getting access denied errors. What is the MOST likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the IAM role.. The most likely cause is that the EC2 instance does not have an instance profile associated with the IAM role. Without an instance profile, the IAM role's credentials are not delivered to the instance metadata service, so the AWS SDK cannot assume the role to sign requests to S3. This results in access denied errors even though the bucket policy explicitly allows s3:GetObject for that role.

Answer

The EC2 instance's security group does not allow outbound traffic to S3.

Answer

The S3 bucket is encrypted with SSE-KMS and the instance does not have kms:Decrypt permissions.

Answer

The S3 bucket has a block public access setting enabled.

Question 2

A company uses AWS Secrets Manager to rotate database credentials for an RDS MySQL instance. The rotation Lambda function fails with the error: 'Secret is scheduled for deletion.' What is the MOST likely cause?

Accepted Answer

The secret has been marked for deletion and is in the waiting period.. The error 'Secret is scheduled for deletion' indicates that the secret has been marked for deletion and is currently in the mandatory waiting period (default 7 to 30 days). During this period, AWS Secrets Manager prevents any operations on the secret, including rotation, to ensure the deletion is intentional. The rotation Lambda function fails because it cannot access or modify a secret that is pending deletion.

Answer

The secret's rotation schedule has been disabled.

Answer

The Lambda function does not have permission to access the secret.

Answer

The RDS instance is not in the same VPC as the Lambda function.

Question 3

A developer needs to grant an IAM user access to list objects in an S3 bucket named 'app-data'. Which IAM policy statement should be used?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::app-data"}. Option C is correct because the s3:ListBucket action is required to list the objects in an S3 bucket, and the resource ARN must specify the bucket itself (arn:aws:s3:::app-data) without a trailing /*. This grants permission to list the contents of the 'app-data' bucket, which is the exact requirement.

Answer

{"Effect":"Allow","Action":"s3:*","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::app-data/*"}

Question 4

A company is using AWS CodeCommit and wants to ensure that all commits are signed with GPG keys. Which approach should be used to enforce this?

Accepted Answer

Create an IAM policy that denies codecommit:GitPush unless the commit is signed.. Option C is correct because AWS CodeCommit does not natively support a 'require signed commits' toggle in the repository settings. Instead, you must use an IAM policy with a condition key like `codecommit:referencedRefName` and a custom condition (e.g., using the `git` protocol's signed commit metadata) to deny `codecommit:GitPush` actions when the commit is not signed. This is the only way to enforce GPG signing at the AWS service level.

Answer

Use AWS Organizations service control policies (SCPs) to deny unsigned commits.

Answer

Enable 'Require signed commits' in the CodeCommit repository settings.

Answer

Use an AWS Lambda function as a pre-commit hook in the repository.

Question 5

A developer is deploying a Lambda function that needs to write logs to CloudWatch Logs. The function's execution role has the AWSLambdaBasicExecutionRole managed policy attached. However, logs are not being written. What is the MOST likely reason?

Accepted Answer

The log group does not exist and the Lambda function cannot create it due to a resource-based policy.. The AWSLambdaBasicExecutionRole managed policy grants permissions to create log streams and write logs to CloudWatch Logs, but it does not grant the `logs:CreateLogGroup` permission. If the log group does not already exist, the Lambda function will fail to write logs because it cannot create the log group. A resource-based policy on the log group can further restrict creation, but the primary issue is the missing `logs:CreateLogGroup` permission in the execution role.

Answer

The Lambda function is using a customer-managed KMS key for log encryption.

Answer

The CloudWatch Logs agent is not installed on the Lambda execution environment.

Answer

The Lambda function's execution role does not have sufficient permissions.

Question 6

A developer needs to securely store database credentials for a serverless application. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It integrates natively with Amazon RDS, Redshift, and DocumentDB to automatically rotate credentials, and it enforces encryption at rest using AWS KMS. For a serverless application, Secrets Manager provides a simple API call (e.g., GetSecretValue) to retrieve credentials without hardcoding them in code or environment variables.

Answer

AWS Key Management Service (KMS)

Answer

Amazon DynamoDB

Answer

AWS Systems Manager Parameter Store

Question 7

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The bucket policy also grants access to the role. An application running on the instance is unable to read objects. The instance has the correct instance profile. What is the MOST likely cause?

Accepted Answer

The bucket policy has a condition that does not match the request context.. The most likely cause is that the bucket policy includes a condition (e.g., aws:SourceIp, aws:SourceVpce, or aws:SecureTransport) that does not match the request context from the EC2 instance. Even though the IAM role grants access, the bucket policy's explicit condition denies the request if the condition key evaluates to false, resulting in an implicit deny. This is a common misconfiguration where the role has permissions but the bucket policy's conditions are too restrictive.

Answer

The EC2 instance's security group blocks outbound traffic to S3.

Answer

The S3 bucket is in a different AWS account.

Answer

The instance profile is not attached to the EC2 instance.

Question 8

A developer is creating a Lambda function that requires access to a DynamoDB table. The function will be invoked by an Amazon API Gateway REST API. What is the BEST way to secure this architecture?

Accepted Answer

Create an IAM role for the Lambda function with a policy granting access to the DynamoDB table.. Option A is correct because the Lambda function needs an execution role—an IAM role that Lambda assumes at runtime—with a policy that grants the specific DynamoDB actions (e.g., GetItem, PutItem) on the target table. This follows the principle of least privilege and is the standard AWS pattern for granting Lambda access to AWS resources. API Gateway invokes the Lambda function via a resource-based policy on the function itself, but that does not affect DynamoDB access; the Lambda execution role handles all downstream permissions.

Answer

Attach a resource-based policy to the DynamoDB table allowing Lambda access.

Answer

Use API Gateway to pass a shared secret to Lambda for DynamoDB access.

Answer

Store the DynamoDB access keys in the Lambda environment variables.

Question 9

A company wants to encrypt data at rest in an S3 bucket using server-side encryption. Which option provides the MOST control over the encryption key?

Accepted Answer

SSE-C (customer-provided keys). SSE-C (customer-provided keys) gives you the most control because you manage the encryption key yourself—you provide the key in each request, and AWS discards it after use. This means you have full lifecycle control over the key material, including rotation, deletion, and access policies, without AWS ever storing the key. In contrast, SSE-KMS and SSE-S3 rely on AWS-managed or AWS-controlled key stores, reducing your direct control.

Answer

SSE-KMS (AWS KMS keys)

Answer

Client-side encryption

Answer

SSE-S3 (S3-managed keys)

Question 10

A developer is building a web application that uses Amazon Cognito for user authentication. Which TWO actions should be taken to secure the application?

Accepted Answer

Enable multi-factor authentication (MFA) for users.. Option A is correct because enabling multi-factor authentication (MFA) adds an extra layer of security beyond just a password, requiring users to provide a second factor (e.g., a one-time code from an authenticator app or SMS). This significantly reduces the risk of unauthorized access due to compromised credentials. Amazon Cognito supports MFA natively, allowing developers to enforce it for user pools.

Answer

Disable token expiration to avoid frequent re-authentication.

Answer

Use IAM users for authentication instead of Cognito.

Answer

Store user tokens in local storage for persistence.

Question 11

A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which THREE steps should be taken?

Accepted Answer

Add a condition in the key policy that allows decrypt only when the principal matches the desired IAM roles.. Option A is correct because key policies in AWS KMS are resource-based policies that directly control access to the CMK. By adding a condition that restricts the `kms:Decrypt` action to only specific IAM roles (using the `aws:PrincipalArn` or `kms:CallerPrincipal` condition key), the security team can ensure that only those roles can decrypt data encrypted with that key. This approach is more secure than relying solely on IAM policies, as key policies are evaluated first and can explicitly deny access even if an IAM policy grants it.

Answer

Grant all IAM users decrypt permission and rely on S3 bucket policies.

Answer

Use separate CMKs for each IAM role to isolate access.

Question 12

A developer needs to securely transfer files from an on-premises server to an S3 bucket. Which TWO methods meet the security requirements?

Accepted Answer

Use AWS Transfer Family with SFTP protocol.. Option B is correct because AWS Transfer Family provides a fully managed service that supports SFTP (SSH File Transfer Protocol) for securely transferring files to Amazon S3. It uses SSH for authentication and encryption, ensuring data in transit is protected without requiring any changes to the on-premises server's existing SFTP infrastructure.

Answer

Use the S3 sync command without any additional configuration.

Answer

Generate a presigned URL and use it with wget.

Answer

Use FTP with TLS.

Question 13

Refer to the exhibit. A developer has attached this resource-based policy to an S3 bucket. The Lambda function 'my-function' is still getting access denied when trying to read objects from the bucket. What is the MOST likely reason?

Accepted Answer

The condition aws:SourceArn does not match the principal's ARN because the principal is the Lambda execution role, not the function.. Option B is correct because the `aws:SourceArn` condition in the resource-based policy expects the ARN of the principal that is making the request. However, when a Lambda function invokes an S3 operation, the principal is the Lambda execution role (e.g., `arn:aws:iam::123456789012:role/my-function-role`), not the function itself (e.g., `arn:aws:lambda:us-east-1:123456789012:function:my-function`). The condition therefore fails, causing an access denied error even though the function's ARN is listed in the policy.

Answer

The bucket name is incorrect in the policy.

Answer

The Lambda function's execution role does not have s3:GetObject permission.

Answer

The policy denies s3:GetObject for the Lambda function.

Question 14

Refer to the exhibit. A developer ran this CLI command and received the output shown. The application is retrieving the secret but getting an authentication error from the database. What is the MOST likely issue?

Accepted Answer

The application is not correctly parsing the JSON SecretString.. The CLI command successfully retrieved the secret, as shown by the output containing the secret value. The application, however, is failing with an authentication error from the database. This indicates that the secret was retrieved but the application is likely misinterpreting the JSON structure of the SecretString. If the secret is stored as a JSON object (e.g., containing username and password fields), the application must parse the JSON and extract the correct field (e.g., 'password'). If it treats the entire JSON string as the password, it will pass an invalid credential to the database, causing an authentication error.

Answer

The secret is not marked as AWSCURRENT.

Answer

The CLI command should have used the --secret-string parameter.

Answer

The secret ID is incorrect.

Question 15

Refer to the exhibit. A developer attached this bucket policy to an S3 bucket. Users from the 192.0.2.0/24 network can access objects, but users from a different network (203.0.113.0/24) get access denied. What change should be made to allow both networks?

Accepted Answer

Change the Condition to use a list of IP ranges: ["192.0.2.0/24", "203.0.113.0/24"].. Option D is correct because the `aws:SourceIp` condition key accepts a list of IP ranges in an array format. By specifying both `192.0.2.0/24` and `203.0.113.0/24` in the condition, the bucket policy will grant access to requests originating from either network, resolving the access denied error for the second network.

Answer

Add a new statement with a different Principal.

Answer

Change the Condition to aws:SourceIp: "203.0.113.0/24".

Answer

Remove the Condition block entirely.