DVA-C02 Security Practice Test 22 — 15 Questions

Question 1

A developer is creating an IAM policy for a Lambda function that needs to read from an SQS queue and write to a DynamoDB table. Which THREE permissions are required? (Select THREE.)

Accepted Answer

sqs:DeleteMessage. A is correct because the Lambda function must delete messages from the SQS queue after processing them to prevent them from being reprocessed. The sqs:DeleteMessage permission is required to call the DeleteMessage API, which removes the message from the queue using its receipt handle. Without this permission, the function would successfully receive and process the message but fail to delete it, causing the message to become visible again after the visibility timeout expires.

Answer

sqs:SendMessage

Answer

dynamodb:GetItem

Question 2

Given the IAM policy above, what is the effective permission for an IAM user?

Accepted Answer

Read-only access to the bucket.. The IAM policy grants only s3:GetObject and s3:ListBucket permissions, which allow reading objects and listing the bucket, and explicitly denies s3:DeleteObject. Since no write permissions (e.g., s3:PutObject) are granted, the effective permission is read-only access (list and get) with delete explicitly denied. Therefore, the user has read-only access to the bucket, not full access.

Answer

No access to the bucket.

Answer

Full access to the bucket including delete.

Answer

Full access to the bucket except delete.

Question 3

What is required for the Lambda function to access the code in the S3 bucket?

Accepted Answer

The Lambda execution role must have s3:GetObject permission on the S3 bucket.. To allow a Lambda function to access AWS resources like an S3 bucket during its execution, it must assume an IAM execution role with the appropriate permissions. To read an object from S3, the execution role must have the `s3:GetObject` permission for the target bucket and object path.

Answer

The S3 bucket policy must grant access to the Lambda service.

Answer

The Lambda function must be in a VPC with an S3 VPC endpoint.

Answer

The S3 bucket must be configured as a static website with CloudFront.

Question 4

A developer is configuring an S3 bucket to host a static website. The bucket policy allows public read access. However, users receive a 403 Forbidden error when accessing the website. What is the most likely cause?

Accepted Answer

The bucket has 'Block all public access' settings enabled.. The 'Block all public access' settings in the S3 bucket's Permissions tab override any bucket policy that grants public read access. Even if the bucket policy explicitly allows s3:GetObject for Principal "*", enabling any of the four block public access settings (especially 'Block public access to buckets and objects granted through new public bucket policies' or 'Block public and cross-account access to buckets and objects through any public bucket policies') will cause S3 to reject all anonymous requests, resulting in a 403 Forbidden error when accessing the static website endpoint.

Answer

The bucket is located in a different AWS region than the website endpoint.

Answer

The bucket name does not match the domain name.

Answer

The bucket is not configured with CloudFront as a content delivery network.

Question 5

A developer needs to grant a Lambda function read-only access to an S3 bucket. Which IAM entity should be used to attach the permissions?

Accepted Answer

Create an IAM role with the necessary permissions and assign it to the Lambda function as the execution role.. Lambda functions require an IAM role (execution role) to obtain temporary AWS credentials via the AWS Security Token Service (STS). This role must have a trust policy allowing Lambda to assume it, and an attached permissions policy granting read-only access to the S3 bucket. This is the standard and secure method for granting permissions to an AWS service like Lambda.

Answer

Create an IAM user and provide the credentials to the Lambda function.

Answer

Attach a resource-based policy to the S3 bucket.

Answer

Attach a policy to an IAM group and add the Lambda function to the group.

Question 6

An application running on an EC2 instance needs to access a DynamoDB table. The instance is in a private subnet. What is the most secure way to grant access without using long-lived credentials?

Accepted Answer

Create an IAM role with DynamoDB access and attach it to the EC2 instance profile.. It uses an IAM role attached to the EC2 instance profile, which allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS). This eliminates the need for long-lived credentials and follows the principle of least privilege. The instance can securely access DynamoDB without storing any secrets on the instance.

Answer

Create a VPC endpoint for DynamoDB and attach a security group to allow access.

Answer

Store IAM user access keys in the application configuration file.

Answer

Use a security group to allow the EC2 instance to communicate with DynamoDB.

Question 7

A company uses AWS KMS to encrypt S3 objects. A developer needs to allow an IAM user to decrypt objects but not encrypt them. Which IAM policy action should be allowed?

Accepted Answer

kms:Decrypt. The correct action is `kms:Decrypt` because the developer's requirement is to allow an IAM user to decrypt S3 objects but not encrypt them. AWS KMS uses separate permissions for encryption and decryption operations; `kms:Decrypt` specifically grants the ability to decrypt ciphertext without granting any encryption capabilities. By allowing only this action, the user can decrypt objects encrypted with the KMS key but cannot encrypt new data or perform any key management operations.

Answer

kms:GenerateDataKey

Answer

kms:Encrypt

Answer

kms:ReEncrypt

Question 8

A developer is using AWS Secrets Manager to rotate database credentials automatically. The rotation fails with the error 'The secret value is not valid JSON.' What is the most likely cause?

Accepted Answer

The secret value was stored as a plain string instead of a JSON object.. AWS Secrets Manager requires secret values to be stored as valid JSON objects when automatic rotation is configured. If the secret is stored as a plain string (e.g., a single password string without key-value pairs), the rotation function cannot parse it, resulting in the 'The secret value is not valid JSON' error. This is because the Lambda rotation function expects to read and write a JSON structure to manage the credentials during rotation.

Answer

The secret is in a different AWS region than the Lambda rotation function.

Answer

The secret name is not base64-encoded.

Answer

The secret does not have the correct version label.

Question 9

A developer needs to enforce encryption in transit for all traffic between an application and an RDS database. Which configuration should be used?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB parameter group.. Setting the 'require_secure_transport' parameter to 'ON' in the DB parameter group enforces TLS/SSL encryption for all connections to the RDS database. This ensures that data in transit between the application and the database is encrypted, meeting the requirement for encryption in transit.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Create a VPC peering connection between the application and database subnets.

Answer

Enable encryption at rest using AWS KMS.

Question 10

A company's S3 bucket policy includes a condition that uses 'aws:SourceIp' to restrict access to a specific IP range. However, requests from that IP range are still denied. What is a possible reason?

Accepted Answer

The request is coming through a VPC endpoint, so the source IP is not the client's IP.. When a request is made through a VPC endpoint (specifically a Gateway Endpoint for S3), the source IP address seen by S3 is the private IP of the VPC endpoint, not the client's original public IP. The 'aws:SourceIp' condition key evaluates the IP address from which the request originates at the network layer, but VPC endpoints use private IPs from the VPC CIDR range, which will not match the public IP range specified in the policy. This causes the condition to fail and the request to be denied, even though the client is within the intended IP range.

Answer

The request is routed through CloudFront, which changes the source IP.

Answer

The bucket owner's IAM user policy overrides the bucket policy.

Answer

The condition key 'aws:SourceIp' is misspelled.

Question 11

A developer is designing a system that must meet PCI DSS compliance. Which THREE AWS services can help with logging and monitoring security events?

Accepted Answer

Amazon CloudWatch Logs. Amazon CloudWatch Logs is correct because it provides a centralized service for collecting, monitoring, and storing log data from various AWS resources and applications. For PCI DSS compliance, CloudWatch Logs can ingest security-related logs (e.g., from EC2, Lambda, or on-premises servers) and enable real-time monitoring, metric filters, and alarms to detect and respond to security events. It also supports log retention policies and encryption at rest using AWS KMS, which are required for audit trails under PCI DSS Requirement 10.

Answer

Amazon VPC Flow Logs

Answer

AWS Key Management Service (KMS)

Question 12

Which TWO actions should a developer take to securely manage database credentials in a serverless application?

Accepted Answer

Store credentials in AWS Secrets Manager and enable automatic rotation.. Option A is correct because AWS Secrets Manager is purpose-built for storing and retrieving secrets such as database credentials, and enabling automatic rotation ensures credentials are periodically changed without manual intervention, reducing the risk of long-lived credential exposure. Option B is correct because IAM database authentication for Amazon RDS lets the Lambda function use its IAM role to generate a short-lived authentication token instead of a static password, eliminating the need to store database credentials at all. Option C is incorrect because embedding credentials in a text file inside the Lambda deployment package exposes them to anyone with access to the code artifact and provides no rotation or auditing. Option D is incorrect because hardcoding credentials in environment variables leaves them in plaintext and visible in the Lambda configuration, and they cannot be rotated automatically. Option E is incorrect because security groups only control network-level access to the database and do not manage or protect the credentials themselves.

Answer

Store credentials in a text file within the Lambda deployment package.

Answer

Hardcode credentials in environment variables.

Answer

Use security groups to allow only the Lambda function to access the database.

Question 13

Which THREE practices help protect data at rest in Amazon S3?

Accepted Answer

Enable MFA Delete.. MFA Delete (B) is correct because it requires multi-factor authentication to permanently delete object versions or change the versioning state of the bucket, protecting stored data from unauthorized deletion or tampering. Server-side encryption (C) is correct because SSE-S3, SSE-KMS, or SSE-C encrypts objects at rest within S3, rendering the stored data unreadable without the appropriate keys. Bucket policies that deny uploads without encryption headers (E) are correct because they enforce encryption at write time, ensuring objects cannot be stored unencrypted in the bucket. Versioning (A) only preserves object versions and aids recovery; it does not itself encrypt or otherwise protect data at rest. Cross-region replication (D) copies objects to another region for durability and availability, but it does not protect the data at rest from unauthorized access.

Answer

Enable versioning.

Answer

Enable cross-region replication.

Question 14

A developer is troubleshooting an issue where an IAM user cannot perform 's3:ListBucket' on a bucket. Which THREE factors could cause this denial?

Accepted Answer

An explicit deny statement in the bucket policy.. Option B is correct because an explicit Deny in a bucket policy always overrides any Allow in an identity-based policy, so a Deny on s3:ListBucket would block the user regardless of other permissions. Option D is correct because a permissions boundary sets the maximum permissions an IAM user can have; if s3:ListBucket is not within the boundary, the effective permissions cannot include it even if an identity policy allows it. Option E is correct because s3:ListBucket must be explicitly granted in an identity-based policy (or another applicable policy) for the user to list the bucket, and its absence results in an implicit deny. Option A is not correct because S3 bucket access is not restricted by the user's default region; region only affects endpoint routing, not authorization. Option C is not correct because KMS encryption affects access to object data via kms:Decrypt, not the s3:ListBucket permission itself.

Answer

The bucket is in a different region than the user's default region.

Answer

The bucket is encrypted with AWS KMS.

Question 15

Refer to the exhibit. An IAM policy allows s3:GetObject for a bucket only from a specific IP range. A developer accesses the bucket from a laptop with IP address 192.0.2.55, but access is denied. What is the most likely reason?

Accepted Answer

The request is made from an AWS service, such as the AWS Management Console, which does not use the laptop's public IP.. When a request is made via the AWS Management Console, the console itself acts as an intermediary. The console's requests originate from AWS service IPs, not the user's laptop public IP. Therefore, the `aws:SourceIp` condition in the IAM policy evaluates against the console's IP, which is not in the allowed range, causing the denial even though the laptop's IP is valid.

Answer

The policy includes an explicit deny statement elsewhere.

Answer

The condition key should be 'aws:SourceIp' without the 'IpAddress' wrapper.

Answer

The laptop's IP address is not within the allowed range.