DVA-C02 Security Practice Test 25 — 15 Questions

Question 1

Refer to the exhibit. A developer applies this IAM policy to an IAM user. What is the effective result when the user attempts to download an object from the 'confidential' folder in the 'my-company-data' bucket?

Accepted Answer

The user cannot download objects from the confidential folder due to the explicit Deny.. The correct answer is A because IAM policies follow an explicit deny override, meaning that even if an Allow statement grants access, an explicit Deny statement for the same action will take precedence. In this policy, the Deny statement explicitly denies s3:GetObject for the 'confidential' folder (using a condition with StringLike on the ARN), so the user cannot download objects from that folder regardless of the Allow statement.

Answer

The user can download objects from the confidential folder but cannot upload to it.

Answer

The user cannot download objects from any folder because the policy is invalid.

Answer

The user can download objects from the confidential folder because the Allow statement grants access.

Question 2

A developer is troubleshooting an issue where an IAM role assumed by an EC2 instance does not have permission to call the DynamoDB PutItem API. The role has a policy that allows all DynamoDB actions on a specific table. Which of the following is the most likely cause?

Accepted Answer

The IAM role policy does not include the 'dynamodb:PutItem' action or the resource ARN is incorrect.. Option C is correct because the most likely cause is that the IAM role's policy either does not explicitly include the 'dynamodb:PutItem' action or the resource ARN is incorrectly specified. Even if the policy allows all DynamoDB actions (e.g., via 'Action': 'dynamodb:*'), a missing or mismatched resource ARN (such as not targeting the specific table ARN) will cause the API call to fail with an access denied error. The developer should verify that the policy statement includes the correct action and that the Resource element points to the exact DynamoDB table ARN.

Answer

The IAM role has not been attached to the EC2 instance profile.

Answer

The DynamoDB table is not in the same region as the EC2 instance.

Answer

The EC2 instance does not have the necessary network connectivity to DynamoDB.

Question 3

Refer to the exhibit. A developer runs the AWS CLI command to decrypt a file using a KMS key alias 'my-key' and receives the error shown. The developer has an IAM policy that allows 'kms:Decrypt' on 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...'. Which additional step is required to resolve this error?

Accepted Answer

Add the user's ARN to the KMS key policy with 'kms:Decrypt' permission.. The error occurs because the KMS key policy does not grant the user permission to decrypt using the key. Even though the user has an IAM policy allowing 'kms:Decrypt' on the key, KMS requires that the key policy explicitly allow IAM user permissions (or grant the user direct access) for IAM policies to take effect. By adding the user's ARN to the key policy with 'kms:Decrypt', the key policy grants the necessary access, resolving the error.

Answer

Attach a policy to the user that allows 'kms:DescribeKey' on the key.

Answer

Use the key ID instead of the alias in the command.

Answer

Enable IAM user permissions in the KMS key policy.

Question 4

A company wants to encrypt data in transit between an Application Load Balancer and its EC2 instances. The instances run a custom web server. Which configuration should the developer implement?

Accepted Answer

Configure the ALB listener with a TLS certificate and set the target group protocol to HTTPS. Install the server certificate on the EC2 instances.. To encrypt data in transit between an Application Load Balancer (ALB) and EC2 instances, the ALB listener must be configured with a TLS certificate for client-to-ALB encryption, and the target group protocol must be set to HTTPS to enable encryption between the ALB and the instances. The EC2 instances must have a server certificate installed (e.g., from ACM or self-signed) to terminate the TLS connection, ensuring end-to-end encryption. This setup allows the ALB to re-encrypt traffic after decrypting it from the client, using HTTPS for the backend connection.

Answer

Use AWS Certificate Manager to issue a certificate for the EC2 instances and configure the web server to use it.

Answer

Configure the ALB listener with a TLS certificate and set the target group protocol to HTTP.

Answer

Enable client certificate authentication on the ALB.

Question 5

A developer needs to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. Which approach is the most secure?

Accepted Answer

Add a bucket policy in Account A that grants access to the user in Account B, and attach an IAM policy to the user in Account B allowing the S3 actions.. Option C is the most secure because it combines a resource-based bucket policy in Account A that explicitly grants access to the user in Account B with an identity-based IAM policy attached to that user in Account B. This dual-policy approach ensures that the user can only access the bucket when both policies allow the action, following the principle of least privilege and avoiding the need to share long-term credentials.

Answer

Create an IAM role in Account A with a trust policy allowing the user from Account B to assume it.

Answer

Share the access keys of an IAM user in Account A with the user in Account B.

Answer

Attach an IAM policy to the user in Account B that grants access to the S3 bucket.

Question 6

Refer to the exhibit. A developer deploys this CloudFormation template. The Lambda function needs to write objects to an S3 bucket named 'my-app-bucket'. What must the developer add to the template?

Accepted Answer

Add a new policy statement to LambdaExecutionRole allowing 's3:PutObject' on 'arn:aws:s3:::my-app-bucket/*'.. Option D is correct because the Lambda function requires an IAM policy attached to its execution role to grant permissions for specific S3 actions. The `s3:PutObject` action on the `arn:aws:s3:::my-app-bucket/*` resource ARN precisely allows writing objects to the bucket, following the principle of least privilege. Without this policy statement, the Lambda function will receive an access denied error when trying to write to S3.

Answer

Add an S3 bucket policy allowing the Lambda function's ARN to write objects.

Answer

Add a policy statement to LambdaExecutionRole allowing 's3:*' on 'arn:aws:s3:::my-app-bucket'.

Answer

Add a KMS key policy to allow the Lambda function to use a customer managed key.

Question 7

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AES-256 (SSE-S3) and that no public access is allowed. Which TWO methods can be used to enforce these requirements across all accounts? (Choose TWO.)

Accepted Answer

Use AWS Config rules with automatic remediation to detect and fix non-compliant buckets.. Option A is correct because AWS Config rules can evaluate S3 bucket configurations against desired settings (e.g., encryption enabled, public access blocked) and trigger automatic remediation via AWS Systems Manager Automation documents to fix non-compliant buckets. This provides continuous enforcement across all accounts in the organization without manual intervention.

Answer

Attach an IAM policy to all IAM users in each account that denies unencrypted operations.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets.

Question 8

A developer is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must authenticate users using a third-party OIDC identity provider and authorize each request. Which THREE steps should the developer take? (Choose THREE.)

Accepted Answer

Create an Amazon Cognito user pool with the OIDC identity provider configured.. Option A is correct because Amazon Cognito user pools can be configured to federate with third-party OIDC identity providers. This allows the user pool to act as an intermediary that handles the OIDC token exchange, issuing its own JWT tokens after successful authentication. This is the standard approach for integrating external OIDC providers with AWS serverless applications.

Answer

Generate an API key and distribute it to users for authentication.

Answer

Create an IAM authorizer in API Gateway to validate the JWT token.

Question 9

A developer is tasked with encrypting data at rest for an Amazon RDS for MySQL database. The developer wants to use AWS KMS for key management. Which TWO configurations are valid? (Choose TWO.)

Accepted Answer

Create a customer managed KMS key and specify it when creating the DB instance.. Option A is correct because you can create a customer managed KMS key and specify it when creating the DB instance. Amazon RDS for MySQL supports encryption at rest using AWS KMS, and you can choose a customer managed key at launch time. This key is used to encrypt the DB instance's storage, automated backups, read replicas, and snapshots.

Answer

Enable encryption after the DB instance is created by modifying the DB instance.

Answer

Use S3 server-side encryption (SSE-S3) with the RDS instance.

Answer

Use an AWS owned KMS key for encryption.

Question 10

A company needs to store application secrets such as database passwords and API keys. The secrets must be automatically rotated every 30 days. Which THREE AWS services or features can be used together to meet this requirement? (Choose THREE.)

Accepted Answer

AWS Lambda to implement the rotation function. AWS Lambda is correct because it can be used as a custom rotation function for AWS Secrets Manager. Secrets Manager natively supports automatic rotation using a Lambda function that updates the secret value in both the service and the database or third-party service. This allows the company to meet the 30-day rotation requirement by scheduling the Lambda function via a CloudWatch Events rule or Secrets Manager's built-in rotation schedule.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 11

A developer is deploying an application that uses Amazon SQS queues. The messages contain sensitive data that must be encrypted at rest. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the SQS queue to use a customer managed KMS key.. Option C is correct because configuring an SQS queue to use a customer managed KMS key gives you control over the key lifecycle, including rotation and access policies, while still leveraging AWS KMS for server-side encryption. Option D is also correct because enabling server-side encryption (SSE) for SQS using AWS KMS encrypts messages at rest automatically, without requiring client-side changes. Together, these two actions ensure that sensitive data in SQS messages is encrypted at rest using KMS, meeting the requirement.

Answer

Encrypt the messages client-side before sending to SQS.

Answer

Store the messages in an S3 bucket with default encryption instead of using SQS.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 12

Refer to the exhibit. A developer created an IAM role for a Lambda function. When the Lambda function invokes, it fails with an access denied error when trying to write logs to CloudWatch Logs. What is the most likely cause?

Accepted Answer

The role lacks a permissions policy that allows CloudWatch Logs actions.. Option C is correct because the Lambda function's IAM role must include a permissions policy that grants the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. Without these permissions, the Lambda runtime cannot write logs to CloudWatch Logs, resulting in an access denied error. The error occurs at invocation time when the Lambda service attempts to create or write to the log stream on behalf of the function.

Answer

The trust policy does not allow the Lambda service to assume the role.

Answer

The CloudWatch Logs log group has a resource-based policy that denies the Lambda function.

Answer

The Lambda function is not associated with this role.

Question 13

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role's trust policy allows the EC2 service, and the permissions policy grants s3:GetObject on the bucket. The application on the instance receives 'Access Denied' errors when trying to read objects. What is the most likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the IAM role.. The most likely cause is that the EC2 instance does not have an instance profile associated with the IAM role. An IAM role must be attached to an EC2 instance via an instance profile, which acts as a container for the role. Without this association, the instance cannot obtain temporary credentials from the AWS Security Token Service (STS) to sign API requests, resulting in 'Access Denied' errors even if the role's trust and permissions policies are correctly configured.

Answer

The IAM role's trust policy does not allow the EC2 service.

Answer

The S3 bucket has default encryption enabled.

Answer

The S3 bucket policy explicitly denies s3:GetObject.

Question 14

A developer is building a serverless application using AWS Lambda functions that need to read and write to an Amazon DynamoDB table. What is the best practice for granting the Lambda function access to DynamoDB?

Accepted Answer

Create an IAM role with a trust policy that allows Lambda to assume it, and attach a permissions policy granting DynamoDB access.. Option A is correct because AWS Lambda functions require an IAM role (execution role) with a trust policy that allows Lambda to assume it, and a permissions policy that grants the necessary DynamoDB actions (e.g., GetItem, PutItem). This is the standard and secure method for granting permissions to Lambda, as it avoids hardcoding credentials and follows the principle of least privilege.

Answer

Create an IAM user and store the access keys in the Lambda environment variables.

Answer

Attach a resource-based policy to the Lambda function that grants DynamoDB access.

Answer

Use the Lambda function's default VPC role to access DynamoDB via a VPC endpoint.

Question 15

A company is designing a multi-account strategy using AWS Organizations. They want to enable cross-account access for developers using IAM roles. Each developer has an IAM user in the 'developers' account. The 'production' account has an IAM role 'AdminRole' that can be assumed by the 'developers' account. Which trust policy should be attached to 'AdminRole'?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]} where 123456789012 is the developers account ID.. Option A is correct because the trust policy on the 'AdminRole' in the production account must allow the entire 'developers' account (using its root ARN) to assume the role. When an IAM user in the developers account calls sts:AssumeRole, AWS evaluates the trust policy; specifying the root ARN of the developers account (arn:aws:iam::123456789012:root) delegates trust to the entire account, and the individual user's permissions are then controlled by an IAM policy attached to the user or a group that grants sts:AssumeRole for this role.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/*"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/AdminRole"},"Action":"sts:AssumeRole"}]}

DVA-C02 Security Practice Test 25 — 15 Questions

Exhibit

DVA-C02 Security Practice Test 25 — 15 Questions

Exhibit