DVA-C02 Security Practice Test 24 — 15 Questions

Question 1

A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that all KMS keys are rotated every year. Which action should be taken?

Accepted Answer

Enable automatic key rotation. AWS KMS supports automatic key rotation for customer-managed KMS keys. When enabled, KMS rotates the key material annually without requiring any manual intervention or application changes. This satisfies the security team's requirement for yearly rotation while maintaining the same key ID and existing encrypted data accessibility.

Answer

Manually rotate the KMS key every year

Answer

Create a new KMS key and update all applications to use it

Answer

Use AWS CloudWatch Events to trigger a Lambda function that rotates the key

Question 2

A developer needs to allow an IAM user to perform only specific actions on an S3 bucket. Which type of policy should be attached to the IAM user?

Accepted Answer

An IAM policy. An IAM policy (Option D) is the correct choice because it is an identity-based policy that can be directly attached to an IAM user, group, or role to grant or deny permissions for specific actions on AWS resources, including S3 buckets. This allows the developer to precisely control which S3 actions (e.g., s3:GetObject, s3:PutObject) the user can perform on a particular bucket, meeting the requirement of limiting the user to specific actions.

Answer

A service control policy

Answer

A bucket policy

Answer

A trust policy

Question 3

A company is using AWS Secrets Manager to rotate database credentials automatically. The rotation Lambda function fails with a timeout. Which action should be taken to resolve this issue?

Accepted Answer

Increase the Lambda function timeout.. The Lambda function is timing out during the rotation process, which indicates that the default 3-second timeout is insufficient for the rotation logic. Increasing the Lambda function timeout (Option B) directly addresses this by allowing the function more time to complete the rotation, such as calling the Secrets Manager API, updating the database, and verifying the new credentials.

Answer

Reduce the rotation schedule interval.

Answer

Place the Lambda function in a VPC with a NAT gateway.

Answer

Store the rotation schedule in EC2 user data.

Question 4

A developer is using AWS KMS to encrypt data in an S3 bucket. The developer wants to ensure that the S3 bucket uses server-side encryption with AWS KMS managed keys (SSE-KMS) by default. Which configuration should be applied?

Accepted Answer

Set the bucket's default encryption to SSE-KMS with a KMS key.. Setting the bucket's default encryption to SSE-KMS with a KMS key ensures that all objects uploaded to the S3 bucket are automatically encrypted using server-side encryption with AWS KMS managed keys (SSE-KMS). This configuration enforces encryption at rest without requiring the client to specify encryption headers in the request, meeting the requirement for default SSE-KMS encryption.

Answer

Add a bucket policy that denies PutObject without the 'x-amz-server-side-encryption' header set to 'aws:kms'.

Answer

Configure the bucket to use SSE-C with a customer-provided key.

Answer

Set the bucket's default encryption to SSE-S3.

Question 5

A developer needs to allow an EC2 instance to read from a DynamoDB table. Which is the best practice to grant permissions?

Accepted Answer

Create an IAM role with the required permissions and attach it to the EC2 instance.. The best practice for granting an EC2 instance permissions to access DynamoDB is to create an IAM role with the required permissions and attach it to the instance. This eliminates the need to manage long-term credentials, as the instance automatically retrieves temporary security credentials from the instance metadata service (IMDS) via the AWS Security Token Service (STS). This approach follows the principle of least privilege and ensures credentials are rotated automatically.

Answer

Generate an IAM user access key and store it in the application configuration.

Answer

Hardcode the AWS credentials in the application code.

Answer

Add the DynamoDB table ARN to the EC2 instance's security group.

Question 6

A company has an S3 bucket that contains sensitive data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS. Which combination of actions will enforce this?

Accepted Answer

Use a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not 'aws:kms'.. A bucket policy that denies PutObject requests when the `x-amz-server-side-encryption` header is not set to `aws:kms` enforces encryption at rest using AWS KMS for all uploads. This policy explicitly rejects any upload that does not include the required KMS encryption header, ensuring compliance with the security team's requirement. Default encryption settings (like SSE-S3 or SSE-KMS) can be overridden by the client, so a bucket policy is the only way to enforce encryption at the API level.

Answer

Configure the bucket to use SSE-S3 by default.

Answer

Enable default encryption on the bucket with SSE-KMS.

Answer

Use a bucket policy that allows only PutObject with KMS encryption.

Question 7

A developer is configuring an S3 bucket to host a static website. The bucket policy allows public read access. However, users receive a 403 Forbidden error when accessing the website. What is the most likely cause?

Accepted Answer

The bucket has 'Block all public access' settings enabled.. The 'Block all public access' settings in the S3 bucket's Permissions tab override any bucket policy that grants public read access. Even if the bucket policy explicitly allows s3:GetObject for Principal "*", enabling any of the four block public access settings (especially 'Block public access to buckets and objects granted through new public bucket policies' or 'Block public and cross-account access to buckets and objects through any public bucket policies') will cause S3 to reject all anonymous requests, resulting in a 403 Forbidden error when accessing the static website endpoint.

Answer

The bucket is located in a different AWS region than the website endpoint.

Answer

The bucket name does not match the domain name.

Answer

The bucket is not configured with CloudFront as a content delivery network.

Question 8

A developer needs to grant a Lambda function read-only access to an S3 bucket. Which IAM entity should be used to attach the permissions?

Accepted Answer

Create an IAM role with the necessary permissions and assign it to the Lambda function as the execution role.. Lambda functions require an IAM role (execution role) to obtain temporary AWS credentials via the AWS Security Token Service (STS). This role must have a trust policy allowing Lambda to assume it, and an attached permissions policy granting read-only access to the S3 bucket. This is the standard and secure method for granting permissions to an AWS service like Lambda.

Answer

Create an IAM user and provide the credentials to the Lambda function.

Answer

Attach a resource-based policy to the S3 bucket.

Answer

Attach a policy to an IAM group and add the Lambda function to the group.

Question 9

An application running on an EC2 instance needs to access a DynamoDB table. The instance is in a private subnet. What is the most secure way to grant access without using long-lived credentials?

Accepted Answer

Create an IAM role with DynamoDB access and attach it to the EC2 instance profile.. It uses an IAM role attached to the EC2 instance profile, which allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS). This eliminates the need for long-lived credentials and follows the principle of least privilege. The instance can securely access DynamoDB without storing any secrets on the instance.

Answer

Create a VPC endpoint for DynamoDB and attach a security group to allow access.

Answer

Store IAM user access keys in the application configuration file.

Answer

Use a security group to allow the EC2 instance to communicate with DynamoDB.

Question 10

A company uses AWS KMS to encrypt S3 objects. A developer needs to allow an IAM user to decrypt objects but not encrypt them. Which IAM policy action should be allowed?

Accepted Answer

kms:Decrypt. The correct action is `kms:Decrypt` because the developer's requirement is to allow an IAM user to decrypt S3 objects but not encrypt them. AWS KMS uses separate permissions for encryption and decryption operations; `kms:Decrypt` specifically grants the ability to decrypt ciphertext without granting any encryption capabilities. By allowing only this action, the user can decrypt objects encrypted with the KMS key but cannot encrypt new data or perform any key management operations.

Answer

kms:GenerateDataKey

Answer

kms:Encrypt

Answer

kms:ReEncrypt

Question 11

A developer is using AWS Secrets Manager to rotate database credentials automatically. The rotation fails with the error 'The secret value is not valid JSON.' What is the most likely cause?

Accepted Answer

The secret value was stored as a plain string instead of a JSON object.. AWS Secrets Manager requires secret values to be stored as valid JSON objects when automatic rotation is configured. If the secret is stored as a plain string (e.g., a single password string without key-value pairs), the rotation function cannot parse it, resulting in the 'The secret value is not valid JSON' error. This is because the Lambda rotation function expects to read and write a JSON structure to manage the credentials during rotation.

Answer

The secret is in a different AWS region than the Lambda rotation function.

Answer

The secret name is not base64-encoded.

Answer

The secret does not have the correct version label.

Question 12

A developer needs to enforce encryption in transit for all traffic between an application and an RDS database. Which configuration should be used?

Accepted Answer

Set the 'require_secure_transport' parameter to 'ON' in the DB parameter group.. Setting the 'require_secure_transport' parameter to 'ON' in the DB parameter group enforces TLS/SSL encryption for all connections to the RDS database. This ensures that data in transit between the application and the database is encrypted, meeting the requirement for encryption in transit.

Answer

Configure the security group to only allow traffic on port 443.

Answer

Create a VPC peering connection between the application and database subnets.

Answer

Enable encryption at rest using AWS KMS.

Question 13

A company's S3 bucket policy includes a condition that uses 'aws:SourceIp' to restrict access to a specific IP range. However, requests from that IP range are still denied. What is a possible reason?

Accepted Answer

The request is coming through a VPC endpoint, so the source IP is not the client's IP.. When a request is made through a VPC endpoint (specifically a Gateway Endpoint for S3), the source IP address seen by S3 is the private IP of the VPC endpoint, not the client's original public IP. The 'aws:SourceIp' condition key evaluates the IP address from which the request originates at the network layer, but VPC endpoints use private IPs from the VPC CIDR range, which will not match the public IP range specified in the policy. This causes the condition to fail and the request to be denied, even though the client is within the intended IP range.

Answer

The request is routed through CloudFront, which changes the source IP.

Answer

The bucket owner's IAM user policy overrides the bucket policy.

Answer

The condition key 'aws:SourceIp' is misspelled.

Question 14

A company requires that all data in an S3 bucket be encrypted at rest. The security team wants to enforce that only objects encrypted with AWS KMS are allowed. Which S3 bucket policy condition key should be used to deny PutObject requests if the object is not encrypted with KMS?

Accepted Answer

s3:x-amz-server-side-encryption-aws-kms-key-id. The `s3:x-amz-server-side-encryption-aws-kms-key-id` condition key specifically checks for the AWS KMS key ID (or alias) used for server-side encryption with AWS KMS (SSE-KMS). By using this key in a bucket policy with a `Deny` effect, you can enforce that only objects encrypted with a specific KMS key are allowed, rejecting any `PutObject` request that does not include the required `x-amz-server-side-encryption-aws-kms-key-id` header.

Answer

s3:x-amz-server-side-encryption-key-id

Answer

s3:x-amz-server-side-encryption

Answer

s3:x-amz-server-side-encryption-kms-key-id

Question 15

A developer is using IAM roles for Amazon EC2 to grant permissions to an application. The application makes API calls to DynamoDB and S3. After deploying, the application fails to access DynamoDB. The developer verifies the IAM role has the correct DynamoDB permissions. What is the most likely cause?

Accepted Answer

The IAM role is not attached to the EC2 instance profile.. For an EC2 instance to use an IAM role, the role must be attached to an EC2 instance profile, which is the container that passes the role's credentials to the instance via the instance metadata service. Even if the IAM role has the correct DynamoDB permissions, if it is not associated with the instance profile, the application will not receive temporary credentials and will fail to access DynamoDB.

Answer

The IAM role does not have a trust policy for EC2.

Answer

The DynamoDB table is in a different region than the EC2 instance.

Answer

The application is using the wrong AWS SDK.