DVA-C02 Security Practice Test 23 — 15 Questions

Question 1

A developer needs to securely store database credentials and retrieve them programmatically from a Lambda function. Which AWS services can be used for this purpose? (Choose TWO.)

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). Options A and B are correct. AWS Systems Manager Parameter Store (SecureString) and AWS Secrets Manager are both designed to securely store database credentials and other secrets, and allow programmatic retrieval from Lambda functions. AWS CloudFormation (option C) is for infrastructure as code, not for storing secrets. AWS IAM (option D) is for managing permissions, not for storing secrets. Amazon S3 (option E) is for object storage and is not a secure secrets management service.

Answer

AWS CloudFormation

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon S3

Question 2

A developer is designing a system that stores sensitive user data in DynamoDB. The data must be encrypted at rest and in transit. Which THREE actions should the developer take?

Accepted Answer

Enable DynamoDB encryption at rest using an AWS KMS managed key (SSE-KMS).. Options A, B, and C are correct. DynamoDB supports encryption at rest using AWS KMS; both SSE-KMS (A) and customer managed keys (B) provide encrypted storage. Using HTTPS (C) ensures encryption in transit. Option D is incorrect because DynamoDB already uses TLS 1.2 by default for all connections, so no explicit action is needed. Option E is unnecessary as server-side encryption and HTTPS provide the required protections.

Answer

Use TLS 1.2 for all connections.

Answer

Implement client-side encryption before writing items to DynamoDB.

Question 3

A developer is using IAM roles to grant permissions to an EC2 instance. Which TWO statements are true about IAM roles for EC2?

Accepted Answer

Temporary security credentials are obtained from the instance metadata service.. An EC2 instance obtains temporary security credentials from the instance metadata service (http://169.254.169.254/latest/meta-data/iam/security-credentials/). Option E is correct because you can attach an IAM role to a running EC2 instance using the AWS CLI or console without stopping the instance. Option A is incorrect because an EC2 instance can have only one IAM role attached at a time (via an instance profile). Option C is incorrect because temporary credentials are automatically refreshed by the AWS SDKs and CLI before they expire (default expiry is 6 hours, but refresh is automatic). Option D is incorrect because the same IAM role can be attached to multiple EC2 instances simultaneously (via the same instance profile).

Answer

An EC2 instance can have multiple IAM roles attached simultaneously.

Answer

The temporary credentials expire after 6 hours and must be manually refreshed.

Answer

An IAM role can only be attached to one EC2 instance at a time.

Question 4

A developer needs to encrypt secrets (database passwords) that are used by an application running on EC2. The application retrieves the secrets at startup. Which combination of services provides the MOST secure and manageable solution?

Accepted Answer

Store the secrets in AWS Secrets Manager and use an IAM role to access them.. AWS Secrets Manager is designed specifically for managing secrets like database passwords, with built-in rotation capabilities and fine-grained access control via IAM roles. Option B is wrong because storing secrets in S3, even with KMS encryption, does not provide automatic rotation and adds complexity in managing access policies. Option C is wrong because AWS Systems Manager Parameter Store SecureString parameters lack native secret rotation (though can be custom scripted) and are less integrated than Secrets Manager for secrets management. Option D is wrong because hardcoding secrets in application code is insecure and violates best practices, as secrets can be exposed in code repositories or decompiled.

Answer

Encrypt the secrets with AWS KMS and store them in an S3 bucket with a bucket policy.

Answer

Store the secrets in AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Hardcode the secrets in the application code and encrypt the code.

Question 5

A developer is using AWS KMS to encrypt data. Which TWO are valid operations that can be performed using KMS?

Accepted Answer

Generate data keys for envelope encryption.. KMS can generate data keys for envelope encryption using the GenerateDataKey API, which returns a plaintext data key and an encrypted copy. Option D is correct because KMS can directly encrypt data (up to 1 KB) using a customer master key via the Encrypt API. Option A is incorrect because KMS does not store keys on an HSM in your data center; AWS manages the HSMs within its infrastructure. Option C is incorrect because KMS does not provide a keyed hash function; hashing is not a KMS operation. Option E is incorrect because KMS does not generate SSL/TLS certificates; that is handled by AWS Certificate Manager (ACM).

Answer

Store customer-managed keys on an HSM in your data center.

Answer

Hash data using a keyed hash function.

Answer

Generate SSL/TLS certificates for a domain.

Question 6

A company wants to audit access to their S3 buckets. Which TWO services can be used to log and monitor S3 API calls?

Accepted Answer

S3 server access logs. S3 server access logs (Option B) provide detailed records about requests made to an S3 bucket, including object-level API calls. AWS CloudTrail (Option C) logs management events for S3, such as bucket creation or configuration changes, and can also be configured to log data events for object-level operations. Option A (AWS Config) is used for resource configuration tracking, not API call logging. Option D (AWS KMS) manages encryption keys. Option E (Amazon CloudWatch Logs) can store logs but does not directly capture S3 API calls; it works with CloudTrail or other sources.

Answer

AWS Config

Answer

AWS KMS

Answer

Amazon CloudWatch Logs

Question 7

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets across all accounts have server-side encryption enabled. They have created an SCP that denies the s3:PutBucketAcl action unless the request includes the x-amz-server-side-encryption header. However, some application teams report that they cannot create buckets even when they include the required header. What is the MOST likely cause of this issue?

Accepted Answer

The SCP is incorrectly targeting s3:PutBucketAcl instead of s3:CreateBucket.. The SCP denies s3:PutBucketAcl, not s3:CreateBucket. The SCP should deny s3:CreateBucket unless the encryption header is present. Option B is wrong because even if the SCP is not applied to the root OU, but only to specific accounts, it would still apply to those accounts; the issue is the action being denied, not the scope. Option C is wrong because if the condition key were misspelled, the condition would simply not be evaluated, and the deny would still block bucket creation despite the header being present. Option D is wrong because SCPs are evaluated before resource-based policies; if the SCP denies the action, the request fails regardless of any resource-based policy that might allow it.

Answer

The SCP is not applied to the root OU, only to specific accounts.

Answer

The condition key in the SCP is misspelled.

Answer

The SCP is being overridden by a resource-based policy on the S3 bucket.

Question 8

A company stores sensitive data in an S3 bucket that must be encrypted at rest. The security team requires that the encryption keys be rotated every 90 days and that access to the keys be auditable. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use SSE-KMS with a customer managed key and enable automatic key rotation.. SSE-KMS with a customer managed key and automatic key rotation meets the requirements with the least operational overhead. SSE-KMS provides auditable access to keys via AWS CloudTrail, and automatic key rotation satisfies the 90-day rotation requirement without manual intervention. Option A (SSE-S3) is incorrect because S3-managed keys cannot be rotated on a schedule. Option B (client-side encryption) adds significant operational overhead for key management and rotation. Option C (SSE-C) requires the company to manage and rotate its own encryption keys, increasing complexity.

Answer

Use SSE-S3 with default encryption enabled.

Answer

Use client-side encryption with the AWS Encryption SDK.

Answer

Use SSE-C with keys stored in AWS Secrets Manager.

Question 9

A company has a DynamoDB table that stores personally identifiable information (PII). A developer needs to allow a Lambda function to read and write to this table. What is the MOST secure way to grant the Lambda function access?

Accepted Answer

Create an IAM role with a policy that allows DynamoDB read/write access and attach it to the Lambda function.. An IAM role with an attached policy granting the necessary permissions is the most secure and best practice. Option B is wrong because resource-based policies on DynamoDB are not supported. Option C is wrong because IAM users should not be used for applications. Option D is wrong because temporary credentials from STS are not needed when using a role.

Answer

Use a resource-based policy on the DynamoDB table to allow the Lambda function's IAM role.

Answer

Create an IAM user with programmatic access and embed the credentials in the Lambda environment variables.

Answer

Have the Lambda function assume a role using AWS STS each time it runs.

Question 10

A developer is creating a new IAM policy to allow users to list objects in a specific S3 bucket. The policy must follow the principle of least privilege. Which policy statement should the developer use?

Accepted Answer

{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::example-bucket"}. It grants s3:ListBucket on the specific bucket. Option A is wrong because it grants s3:ListAllMyBuckets which lists all buckets, not just the specific one. Option C is wrong because s3:PutObject is for uploading objects, not listing. Option D is wrong because s3:GetObject is for reading objects, not listing.

Answer

{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"}

Answer

{"Effect":"Allow","Action":"s3:PutObject","Resource":"arn:aws:s3:::example-bucket/*"}

Answer

{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::example-bucket/*"}

Question 11

A company wants to encrypt data at rest in an Amazon RDS for MySQL DB instance. Which of the following are true about RDS encryption? (Select THREE.)

Accepted Answer

Encryption at rest can be enabled when you create the DB instance.. Encryption at rest for Amazon RDS MySQL can only be enabled when you create the DB instance (B). Once created, you cannot enable encryption on an unencrypted instance (A is false). When encryption is enabled, snapshots (C), automated backups (D), and read replicas are all encrypted. Read replicas of an encrypted instance must also be encrypted, so E is false. Therefore, options B, C, and D are correct.

Answer

Encryption at rest can be enabled on an existing unencrypted DB instance.

Answer

Read replicas of an encrypted instance can be unencrypted.

Question 12

A developer wants to securely store database credentials used by a Lambda function. The credentials should be automatically rotated every 90 days. Which service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials and other secrets. It supports native rotation with built-in integration for Amazon RDS (MySQL, PostgreSQL, Oracle, SQL Server, MariaDB) and Amazon DocumentDB, allowing you to configure automatic rotation every 90 days without custom code. The service encrypts secrets at rest using AWS KMS and enforces fine-grained access control via IAM policies.

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM)

Answer

AWS Systems Manager Parameter Store

Question 13

A company has an S3 bucket that stores sensitive customer data. The security team requires that all data be encrypted at rest using server-side encryption with AWS KMS. Additionally, they want to enforce that objects are not uploaded without encryption. Which bucket policy should be used?

Accepted Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value aws:kms. It uses a Deny effect with a condition that checks for the presence and value of the `x-amz-server-side-encryption` header. This policy explicitly denies any `s3:PutObject` request that does NOT include `x-amz-server-side-encryption` with the value `aws:kms`, thereby enforcing server-side encryption with AWS KMS (SSE-KMS) on all uploads.

Answer

Deny s3:PutObject if the request includes x-amz-server-side-encryption

Answer

Allow s3:PutObject only if the request uses a specific KMS key

Answer

Deny s3:PutObject unless the request includes x-amz-server-side-encryption with value AES256

Question 14

A developer is using the AWS CLI to upload a file to an S3 bucket with server-side encryption. The bucket is configured with default encryption (SSE-S3). The developer wants to ensure the object is encrypted with SSE-KMS instead. What should the developer do?

Accepted Answer

Use the --sse aws:kms parameter when uploading. The developer must explicitly specify the server-side encryption method at the time of upload using the `--sse aws:kms` parameter in the AWS CLI. This overrides the bucket's default SSE-S3 encryption, ensuring the object is encrypted with SSE-KMS. Without this parameter, the object inherits the bucket's default encryption (SSE-S3), regardless of any other settings.

Answer

Use the --kms-key-id parameter with a KMS key ARN

Answer

No action needed; the bucket default encryption will apply

Answer

Change the bucket policy to require SSE-KMS

Question 15

An application running on an EC2 instance needs to access a DynamoDB table. The instance is in a private subnet without internet access. Which method should be used to grant the instance access to DynamoDB securely?

Accepted Answer

Create a VPC endpoint for DynamoDB and attach an IAM role to the instance. A VPC Gateway Endpoint for DynamoDB allows EC2 instances in a private subnet to access DynamoDB without traversing the internet or requiring a NAT gateway. By attaching an IAM role to the EC2 instance, the application can securely obtain temporary credentials via the instance metadata service, eliminating the need to store long-term credentials on the instance.

Answer

Store AWS credentials in a file on the instance and use them in the application

Answer

Configure security group rules to allow outbound traffic to DynamoDB

Answer

Attach a NAT gateway to the private subnet and use IAM user credentials