DVA-C02 Security Practice Test 26 — 15 Questions

Question 1

A developer needs to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. Which approach is the most secure?

Accepted Answer

Add a bucket policy in Account A that grants access to the user in Account B, and attach an IAM policy to the user in Account B allowing the S3 actions.. The most secure because it combines a resource-based bucket policy in Account A that explicitly grants access to the user in Account B with an identity-based IAM policy attached to that user in Account B. This dual-policy approach ensures that the user can only access the bucket when both policies allow the action, following the principle of least privilege and avoiding the need to share long-term credentials.

Answer

Create an IAM role in Account A with a trust policy allowing the user from Account B to assume it.

Answer

Share the access keys of an IAM user in Account A with the user in Account B.

Answer

Attach an IAM policy to the user in Account B that grants access to the S3 bucket.

Question 2

Refer to the exhibit. A developer deploys this CloudFormation template. The Lambda function needs to write objects to an S3 bucket named 'my-app-bucket'. What must the developer add to the template?

Accepted Answer

Add a new policy statement to LambdaExecutionRole allowing 's3:PutObject' on 'arn:aws:s3:::my-app-bucket/*'.. The Lambda function requires an IAM policy attached to its execution role to grant permissions for specific S3 actions. The `s3:PutObject` action on the `arn:aws:s3:::my-app-bucket/*` resource ARN precisely allows writing objects to the bucket, following the principle of least privilege. Without this policy statement, the Lambda function will receive an access denied error when trying to write to S3.

Answer

Add an S3 bucket policy allowing the Lambda function's ARN to write objects.

Answer

Add a policy statement to LambdaExecutionRole allowing 's3:*' on 'arn:aws:s3:::my-app-bucket'.

Answer

Add a KMS key policy to allow the Lambda function to use a customer managed key.

Question 3

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets are encrypted with AES-256 (SSE-S3) and that no public access is allowed. Which TWO methods can be used to enforce these requirements across all accounts? (Choose TWO.)

Accepted Answer

Use AWS Config rules with automatic remediation to detect and fix non-compliant buckets.. AWS Config rules can evaluate S3 bucket configurations against desired settings (e.g., encryption enabled, public access blocked) and trigger automatic remediation via AWS Systems Manager Automation documents to fix non-compliant buckets. This provides continuous enforcement across all accounts in the organization without manual intervention.

Answer

Attach an IAM policy to all IAM users in each account that denies unencrypted operations.

Answer

Enable AWS CloudTrail to log all S3 API calls and send alerts.

Answer

Use AWS Trusted Advisor to check for unencrypted buckets.

Question 4

A developer is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application must authenticate users using a third-party OIDC identity provider and authorize each request. Which THREE steps should the developer take? (Choose THREE.)

Accepted Answer

Create an Amazon Cognito user pool with the OIDC identity provider configured.. Amazon Cognito user pools can be configured to federate with third-party OIDC identity providers. This allows the user pool to act as an intermediary that handles the OIDC token exchange, issuing its own JWT tokens after successful authentication. This is the standard approach for integrating external OIDC providers with AWS serverless applications.

Answer

Generate an API key and distribute it to users for authentication.

Answer

Create an IAM authorizer in API Gateway to validate the JWT token.

Question 5

A developer is tasked with encrypting data at rest for an Amazon RDS for MySQL database. The developer wants to use AWS KMS for key management. Which TWO configurations are valid? (Choose TWO.)

Accepted Answer

Create a customer managed KMS key and specify it when creating the DB instance.. You can create a customer managed KMS key and specify it when creating the DB instance. Amazon RDS for MySQL supports encryption at rest using AWS KMS, and you can choose a customer managed key at launch time. This key is used to encrypt the DB instance's storage, automated backups, read replicas, and snapshots.

Answer

Enable encryption after the DB instance is created by modifying the DB instance.

Answer

Use S3 server-side encryption (SSE-S3) with the RDS instance.

Answer

Use an AWS owned KMS key for encryption.

Question 6

A company needs to store application secrets such as database passwords and API keys. The secrets must be automatically rotated every 30 days. Which THREE AWS services or features can be used together to meet this requirement? (Choose THREE.)

Accepted Answer

AWS Lambda to implement the rotation function. AWS Lambda is correct because it can be used as a custom rotation function for AWS Secrets Manager. Secrets Manager natively supports automatic rotation using a Lambda function that updates the secret value in both the service and the database or third-party service. This allows the company to meet the 30-day rotation requirement by scheduling the Lambda function via a CloudWatch Events rule or Secrets Manager's built-in rotation schedule.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 7

A developer is deploying an application that uses Amazon SQS queues. The messages contain sensitive data that must be encrypted at rest. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the SQS queue to use a customer managed KMS key.. Configuring an SQS queue to use a customer managed KMS key gives you control over the key lifecycle, including rotation and access policies, while still leveraging AWS KMS for server-side encryption. Option D is also correct because enabling server-side encryption (SSE) for SQS using AWS KMS encrypts messages at rest automatically, without requiring client-side changes. Together, these two actions ensure that sensitive data in SQS messages is encrypted at rest using KMS, meeting the requirement.

Answer

Encrypt the messages client-side before sending to SQS.

Answer

Store the messages in an S3 bucket with default encryption instead of using SQS.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 8

Refer to the exhibit. A developer created an IAM role for a Lambda function. When the Lambda function invokes, it fails with an access denied error when trying to write logs to CloudWatch Logs. What is the most likely cause?

Accepted Answer

The role lacks a permissions policy that allows CloudWatch Logs actions.. The Lambda function's IAM role must include a permissions policy that grants the `logs:CreateLogGroup`, `logs:CreateLogStream`, and `logs:PutLogEvents` actions. Without these permissions, the Lambda runtime cannot write logs to CloudWatch Logs, resulting in an access denied error. The error occurs at invocation time when the Lambda service attempts to create or write to the log stream on behalf of the function.

Answer

The trust policy does not allow the Lambda service to assume the role.

Answer

The CloudWatch Logs log group has a resource-based policy that denies the Lambda function.

Answer

The Lambda function is not associated with this role.

Question 9

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role's trust policy allows the EC2 service, and the permissions policy grants s3:GetObject on the bucket. The application on the instance receives 'Access Denied' errors when trying to read objects. What is the most likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the IAM role.. The most likely cause is that the EC2 instance does not have an instance profile associated with the IAM role. An IAM role must be attached to an EC2 instance via an instance profile, which acts as a container for the role. Without this association, the instance cannot obtain temporary credentials from the AWS Security Token Service (STS) to sign API requests, resulting in 'Access Denied' errors even if the role's trust and permissions policies are correctly configured.

Answer

The IAM role's trust policy does not allow the EC2 service.

Answer

The S3 bucket has default encryption enabled.

Answer

The S3 bucket policy explicitly denies s3:GetObject.

Question 10

A developer is building a serverless application using AWS Lambda functions that need to read and write to an Amazon DynamoDB table. What is the best practice for granting the Lambda function access to DynamoDB?

Accepted Answer

Create an IAM role with a trust policy that allows Lambda to assume it, and attach a permissions policy granting DynamoDB access.. AWS Lambda functions require an IAM role (execution role) with a trust policy that allows Lambda to assume it, and a permissions policy that grants the necessary DynamoDB actions (e.g., GetItem, PutItem). This is the standard and secure method for granting permissions to Lambda, as it avoids hardcoding credentials and follows the principle of least privilege.

Answer

Create an IAM user and store the access keys in the Lambda environment variables.

Answer

Attach a resource-based policy to the Lambda function that grants DynamoDB access.

Answer

Use the Lambda function's default VPC role to access DynamoDB via a VPC endpoint.

Question 11

A company is designing a multi-account strategy using AWS Organizations. They want to enable cross-account access for developers using IAM roles. Each developer has an IAM user in the 'developers' account. The 'production' account has an IAM role 'AdminRole' that can be assumed by the 'developers' account. Which trust policy should be attached to 'AdminRole'?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]} where 123456789012 is the developers account ID.. The trust policy on the 'AdminRole' in the production account must allow the entire 'developers' account (using its root ARN) to assume the role. When an IAM user in the developers account calls sts:AssumeRole, AWS evaluates the trust policy; specifying the root ARN of the developers account (arn:aws:iam::123456789012:root) delegates trust to the entire account, and the individual user's permissions are then controlled by an IAM policy attached to the user or a group that grants sts:AssumeRole for this role.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/*"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/AdminRole"},"Action":"sts:AssumeRole"}]}

Question 12

A developer is using AWS Secrets Manager to store database credentials. The application runs on EC2 and needs to retrieve the secret. Which approach is the most secure?

Accepted Answer

Use an IAM role attached to the EC2 instance with permissions to access the secret, and call the AWS SDK to retrieve it at runtime.. It follows the principle of least privilege and avoids hardcoding or storing secrets in insecure locations. By attaching an IAM role to the EC2 instance, the application can securely retrieve the secret from AWS Secrets Manager at runtime using the AWS SDK, without ever exposing the secret in code, configuration files, or environment variables. This approach leverages IAM's temporary credentials from the instance metadata service (IMDS) to authenticate the SDK call, ensuring the secret is never persisted locally.

Answer

Store the secret in an environment variable in the user data script.

Answer

Retrieve the secret at application startup and store it in a configuration file.

Answer

Download the secret from an S3 bucket using pre-signed URLs.

Question 13

A company uses AWS KMS to encrypt data in Amazon S3. They have a Customer Master Key (CMK) with key rotation enabled. The S3 bucket has default encryption using SSE-KMS with this CMK. An application writes objects to the bucket. Which statement about the encryption is correct?

Accepted Answer

The CMK is used to generate a data key that encrypts the object, and the encrypted data key is stored with the object.. AWS KMS uses envelope encryption: when an object is written to S3 with SSE-KMS, KMS generates a unique data key from the CMK, encrypts the object with that data key, and then stores the encrypted data key alongside the object in S3. The CMK itself never directly encrypts the object data; it only encrypts the data key. This ensures that the CMK can be rotated without affecting the encrypted objects, as the encrypted data key remains decryptable by the new key material if the key ID is the same.

Answer

The CMK directly encrypts the object data.

Answer

When the CMK is rotated, all existing objects in the bucket are automatically re-encrypted with the new key.

Answer

Each object is encrypted with a unique data key that is stored alongside the object.

Question 14

A developer needs to grant an IAM user in Account A access to an S3 bucket in Account B. What is the correct combination of policies?

Accepted Answer

An IAM policy in Account A allowing access to the S3 bucket, and a bucket policy in Account B allowing the IAM user.. Cross-account S3 access requires two policies: an IAM policy in the source account (Account A) granting the user permission to perform S3 actions on the bucket, and a bucket policy in the target account (Account B) that explicitly allows the IAM user's ARN. The bucket policy acts as a resource-based policy that delegates access to the external principal, while the IAM policy authorizes the user to make the request. Without both, the request will be denied by either the source account's implicit deny or the target account's default deny.

Answer

An S3 bucket policy in Account B that allows the IAM user's ARN.

Answer

An IAM policy in Account A allowing access, and a bucket ACL in Account B granting access to the IAM user.

Answer

Create an IAM role in Account B that the user can assume, and attach a bucket policy allowing the role.

Question 15

An application uses Amazon Cognito user pools for authentication. A developer wants to restrict access to an API Gateway endpoint to only authenticated users from a specific user pool. What is the best approach?

Accepted Answer

Use a Cognito User Pool authorizer in API Gateway.. A Cognito User Pool authorizer in API Gateway is the native, fully managed way to restrict access to an API endpoint to authenticated users from a specific user pool. It automatically validates the JWT token issued by the user pool and caches the result, requiring no custom code. This approach integrates directly with API Gateway's authorization flow, ensuring only tokens from the specified user pool are accepted.

Answer

Attach an IAM policy to the API Gateway resource that allows only the Cognito user pool ARN.

Answer

Use an API Gateway resource policy that allows access only from the Cognito user pool.

Answer

Use a Lambda authorizer that validates the JWT token against the user pool.