DVA-C02 Security Practice Test 24 — 15 Questions

Question 1

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The bucket policy also grants access to the role. An application running on the instance is unable to read objects. The instance has the correct instance profile. What is the MOST likely cause?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The bucket policy has a condition that does not match the request context.. The most likely cause is that the bucket policy includes a condition (e.g., aws:SourceIp, aws:SourceVpce, or aws:SecureTransport) that does not match the request context from the EC2 instance. Even though the IAM role grants access, the bucket policy's explicit condition denies the request if the condition key evaluates to false, resulting in an implicit deny. This is a common misconfiguration where the role has permissions but the bucket policy's conditions are too restrictive.

Answer

The EC2 instance's security group blocks outbound traffic to S3.

Answer

The S3 bucket is in a different AWS account.

Answer

The instance profile is not attached to the EC2 instance.

Question 2

A developer is creating a Lambda function that requires access to a DynamoDB table. The function will be invoked by an Amazon API Gateway REST API. What is the BEST way to secure this architecture?

Accepted Answer

Create an IAM role for the Lambda function with a policy granting access to the DynamoDB table.. The Lambda function needs an execution role—an IAM role that Lambda assumes at runtime—with a policy that grants the specific DynamoDB actions (e.g., GetItem, PutItem) on the target table. This follows the principle of least privilege and is the standard AWS pattern for granting Lambda access to AWS resources. API Gateway invokes the Lambda function via a resource-based policy on the function itself, but that does not affect DynamoDB access; the Lambda execution role handles all downstream permissions.

Answer

Attach a resource-based policy to the DynamoDB table allowing Lambda access.

Answer

Use API Gateway to pass a shared secret to Lambda for DynamoDB access.

Answer

Store the DynamoDB access keys in the Lambda environment variables.

Question 3

A company wants to encrypt data at rest in an S3 bucket using server-side encryption. Which option provides the MOST control over the encryption key?

Accepted Answer

SSE-C (customer-provided keys). SSE-C (customer-provided keys) gives you the most control because you manage the encryption key yourself—you provide the key in each request, and AWS discards it after use. This means you have full lifecycle control over the key material, including rotation, deletion, and access policies, without AWS ever storing the key. In contrast, SSE-KMS and SSE-S3 rely on AWS-managed or AWS-controlled key stores, reducing your direct control.

Answer

SSE-KMS (AWS KMS keys)

Answer

Client-side encryption

Answer

SSE-S3 (S3-managed keys)

Question 4

A developer is building a web application that uses Amazon Cognito for user authentication. Which TWO actions should be taken to secure the application?

Accepted Answer

Enable multi-factor authentication (MFA) for users.. Enabling multi-factor authentication (MFA) adds an extra layer of security beyond just a password, requiring users to provide a second factor (e.g., a one-time code from an authenticator app or SMS). This significantly reduces the risk of unauthorized access due to compromised credentials. Amazon Cognito supports MFA natively, allowing developers to enforce it for user pools.

Answer

Disable token expiration to avoid frequent re-authentication.

Answer

Use IAM users for authentication instead of Cognito.

Answer

Store user tokens in local storage for persistence.

Question 5

A company uses AWS KMS to encrypt data in S3. The security team wants to ensure that only specific IAM roles can decrypt the data. Which THREE steps should be taken?

Accepted Answer

Add a condition in the key policy that allows decrypt only when the principal matches the desired IAM roles.. Key policies in AWS KMS are resource-based policies that directly control access to the CMK. By adding a condition that restricts the `kms:Decrypt` action to only specific IAM roles (using the `aws:PrincipalArn` or `kms:CallerPrincipal` condition key), the security team can ensure that only those roles can decrypt data encrypted with that key. This approach is more secure than relying solely on IAM policies, as key policies are evaluated first and can explicitly deny access even if an IAM policy grants it.

Answer

Grant all IAM users decrypt permission and rely on S3 bucket policies.

Answer

Use separate CMKs for each IAM role to isolate access.

Question 6

Refer to the exhibit. A developer ran this CLI command and received the output shown. The application is retrieving the secret but getting an authentication error from the database. What is the MOST likely issue?

Accepted Answer

The application is not correctly parsing the JSON SecretString.. The CLI command successfully retrieved the secret, as shown by the output containing the secret value. The application, however, is failing with an authentication error from the database. This indicates that the secret was retrieved but the application is likely misinterpreting the JSON structure of the SecretString. If the secret is stored as a JSON object (e.g., containing username and password fields), the application must parse the JSON and extract the correct field (e.g., 'password'). If it treats the entire JSON string as the password, it will pass an invalid credential to the database, causing an authentication error.

Answer

The secret is not marked as AWSCURRENT.

Answer

The CLI command should have used the --secret-string parameter.

Answer

The secret ID is incorrect.

Question 7

Refer to the exhibit. A developer attached this bucket policy to an S3 bucket. Users from the 192.0.2.0/24 network can access objects, but users from a different network (203.0.113.0/24) get access denied. What change should be made to allow both networks?

Accepted Answer

Change the Condition to use a list of IP ranges: ["192.0.2.0/24", "203.0.113.0/24"].. The `aws:SourceIp` condition key accepts a list of IP ranges in an array format. By specifying both `192.0.2.0/24` and `203.0.113.0/24` in the condition, the bucket policy will grant access to requests originating from either network, resolving the access denied error for the second network.

Answer

Add a new statement with a different Principal.

Answer

Change the Condition to aws:SourceIp: "203.0.113.0/24".

Answer

Remove the Condition block entirely.

Question 8

A company is using AWS KMS to encrypt sensitive data stored in S3. The security team wants to ensure that only a specific IAM role can decrypt the data. What is the most secure way to achieve this?

Accepted Answer

Create a KMS key policy that grants the role the kms:Decrypt permission.. KMS key policies are the most direct and secure way to control who can perform cryptographic operations like kms:Decrypt on a specific CMK. By granting only the specific IAM role the kms:Decrypt permission in the key policy, you ensure that no other principal (including the root user or other roles) can decrypt the data, even if they have S3 access. This follows the principle of least privilege and decouples data access from infrastructure access.

Answer

Use S3 server-side encryption with S3-managed keys (SSE-S3).

Answer

Enable automatic key rotation for the KMS key.

Answer

Use an S3 bucket policy to restrict access to the role.

Question 9

A company uses AWS Lambda to process sensitive data. The Lambda function needs to access an RDS database with a password stored in AWS Secrets Manager. The function currently retrieves the secret using the AWS SDK. What is the best practice to secure this setup?

Accepted Answer

Configure the Lambda function to use IAM database authentication for RDS.. IAM database authentication eliminates the need to store or retrieve a password entirely. The Lambda function assumes an IAM role that generates a temporary authentication token (valid for 15 minutes) using the AWS SDK, which is then used to connect to RDS via TLS. This approach follows the principle of least privilege and removes the risk of static credentials being exposed or misused.

Answer

Store the password as a Lambda environment variable encrypted with KMS.

Answer

Use the AWS CLI within the Lambda function to fetch the secret each time.

Answer

Rotate the secret daily using Secrets Manager and cache it in Lambda.

Question 10

A developer needs to grant a Lambda function permission to write logs to CloudWatch Logs. Which IAM entity should be used?

Accepted Answer

Create an IAM execution role with the necessary permissions and associate it with the function.. Lambda functions require an IAM execution role to obtain temporary credentials for accessing other AWS services. This role must include a trust policy allowing Lambda to assume it and a permissions policy granting the specific actions (e.g., logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents) on CloudWatch Logs. Associating this role with the function is the standard and secure way to grant permissions.

Answer

Attach an inline policy to the Lambda function.

Answer

Use a service control policy (SCP) to allow logging.

Answer

Add a resource-based policy to the Lambda function.

Question 11

An application running on EC2 needs to access an S3 bucket. The security team wants to avoid using long-term access keys. What is the most secure approach?

Accepted Answer

Launch the EC2 instance with an IAM role that grants S3 access.. Assigning an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS) automatically via the instance metadata service. This eliminates the need to store, rotate, or manage long-term access keys, adhering to the security team's requirement for a credential-less approach. The IAM role's permissions policy grants the EC2 instance access to the S3 bucket, and the credentials are automatically rotated by AWS before they expire.

Answer

Generate an access key and secret key for an IAM user and store them on the instance.

Answer

Create a new IAM user and store the credentials in S3 with bucket policies.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and retrieve them at runtime.

Question 12

A company uses AWS CloudFormation to deploy resources. The templates are stored in an S3 bucket. A developer wants to ensure that only authorized users can create stacks from these templates. What should be implemented?

Accepted Answer

Use IAM policies to control who can call CreateStack and add S3 bucket policies to restrict template access.. It combines two layers of access control: IAM policies restrict the ability to call the CreateStack API action, and S3 bucket policies restrict access to the template objects stored in S3. This ensures that even if a user has IAM permissions to create stacks, they cannot retrieve or use the template unless the S3 bucket policy also grants them access. Without both controls, an unauthorized user could bypass IAM by directly accessing the template URL or using a different AWS account.

Answer

Use a stack policy to restrict updates.

Answer

Enable CloudTrail to log template access.

Answer

Set the S3 bucket to private and rely on bucket policies.

Question 13

A developer is building a web application that must encrypt data in transit. Which AWS service should be used to manage SSL/TLS certificates?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it is specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services (e.g., Elastic Load Balancers, CloudFront, API Gateway). It handles the full lifecycle of certificates, including renewal, which directly addresses the requirement to encrypt data in transit using HTTPS.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 14

A company has a requirement to automatically rotate database credentials every 30 days. Which AWS service can meet this requirement with minimal development effort?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it provides built-in, automated rotation of database credentials without custom code. You can define a rotation schedule (e.g., every 30 days) and Secrets Manager will automatically update the secret and the database password using a Lambda function, meeting the requirement with minimal development effort.

Answer

AWS KMS

Answer

AWS IAM

Answer

AWS Systems Manager Parameter Store

Question 15

Which THREE components are required to enable encryption in transit for an Application Load Balancer? (Choose THREE.)

Accepted Answer

A security group rule allowing inbound traffic on port 443. A security group rule allowing inbound traffic on port 443 is required because the Application Load Balancer (ALB) must accept HTTPS traffic from clients. Without this rule, the ALB's network interface will drop encrypted connections, preventing any TLS handshake from completing. This ensures that traffic between clients and the ALB is encrypted in transit.

Answer

Server Name Indication (SNI) support

Answer

An HTTP to HTTPS redirect rule