DVA-C02 Security Practice Test 26 — 15 Questions

Question 1

A company uses AWS Lambda to process sensitive data. The Lambda function needs to access an RDS database with a password stored in AWS Secrets Manager. The function currently retrieves the secret using the AWS SDK. What is the best practice to secure this setup?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Configure the Lambda function to use IAM database authentication for RDS.. IAM database authentication eliminates the need to store or retrieve a password entirely. The Lambda function assumes an IAM role that generates a temporary authentication token (valid for 15 minutes) using the AWS SDK, which is then used to connect to RDS via TLS. This approach follows the principle of least privilege and removes the risk of static credentials being exposed or misused.

Answer

Store the password as a Lambda environment variable encrypted with KMS.

Answer

Use the AWS CLI within the Lambda function to fetch the secret each time.

Answer

Rotate the secret daily using Secrets Manager and cache it in Lambda.

Question 2

A developer needs to grant a Lambda function permission to write logs to CloudWatch Logs. Which IAM entity should be used?

Accepted Answer

Create an IAM execution role with the necessary permissions and associate it with the function.. Lambda functions require an IAM execution role to obtain temporary credentials for accessing other AWS services. This role must include a trust policy allowing Lambda to assume it and a permissions policy granting the specific actions (e.g., logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents) on CloudWatch Logs. Associating this role with the function is the standard and secure way to grant permissions.

Answer

Attach an inline policy to the Lambda function.

Answer

Use a service control policy (SCP) to allow logging.

Answer

Add a resource-based policy to the Lambda function.

Question 3

An application running on EC2 needs to access an S3 bucket. The security team wants to avoid using long-term access keys. What is the most secure approach?

Accepted Answer

Launch the EC2 instance with an IAM role that grants S3 access.. Assigning an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS) automatically via the instance metadata service. This eliminates the need to store, rotate, or manage long-term access keys, adhering to the security team's requirement for a credential-less approach. The IAM role's permissions policy grants the EC2 instance access to the S3 bucket, and the credentials are automatically rotated by AWS before they expire.

Answer

Generate an access key and secret key for an IAM user and store them on the instance.

Answer

Create a new IAM user and store the credentials in S3 with bucket policies.

Answer

Use AWS Systems Manager Parameter Store to store the credentials and retrieve them at runtime.

Question 4

A company uses AWS CloudFormation to deploy resources. The templates are stored in an S3 bucket. A developer wants to ensure that only authorized users can create stacks from these templates. What should be implemented?

Accepted Answer

Use IAM policies to control who can call CreateStack and add S3 bucket policies to restrict template access.. It combines two layers of access control: IAM policies restrict the ability to call the CreateStack API action, and S3 bucket policies restrict access to the template objects stored in S3. This ensures that even if a user has IAM permissions to create stacks, they cannot retrieve or use the template unless the S3 bucket policy also grants them access. Without both controls, an unauthorized user could bypass IAM by directly accessing the template URL or using a different AWS account.

Answer

Use a stack policy to restrict updates.

Answer

Enable CloudTrail to log template access.

Answer

Set the S3 bucket to private and rely on bucket policies.

Question 5

A developer is building a web application that must encrypt data in transit. Which AWS service should be used to manage SSL/TLS certificates?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it is specifically designed to provision, manage, and deploy public and private SSL/TLS certificates for use with AWS services (e.g., Elastic Load Balancers, CloudFront, API Gateway). It handles the full lifecycle of certificates, including renewal, which directly addresses the requirement to encrypt data in transit using HTTPS.

Answer

AWS KMS

Answer

AWS Secrets Manager

Answer

AWS CloudHSM

Question 6

A developer is debugging an issue where an IAM user cannot list objects in an S3 bucket. The user has the following IAM policy attached: { "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::example-bucket" } ] }. What is missing?

Accepted Answer

The policy needs to also allow s3:GetObject on the objects.. The IAM policy only grants the s3:ListBucket permission, which allows listing the objects in the bucket but not reading their contents. To actually list objects, the s3:ListBucket action is sufficient; however, the question implies the user cannot list objects at all. The missing permission is s3:GetObject, which is required to retrieve object metadata and data when using certain S3 operations like GetObject or HeadObject. Without s3:GetObject, the user may fail to list objects if the bucket policy or ACLs require read access for the listing operation to succeed.

Answer

The Resource ARN is incorrect.

Answer

The bucket has a bucket policy that denies access.

Answer

The user needs to enable S3 ACLs.

Question 7

Which THREE components are required to enable encryption in transit for an Application Load Balancer? (Choose THREE.)

Accepted Answer

A security group rule allowing inbound traffic on port 443. A security group rule allowing inbound traffic on port 443 is required because the Application Load Balancer (ALB) must accept HTTPS traffic from clients. Without this rule, the ALB's network interface will drop encrypted connections, preventing any TLS handshake from completing. This ensures that traffic between clients and the ALB is encrypted in transit.

Answer

Server Name Indication (SNI) support

Answer

An HTTP to HTTPS redirect rule

Question 8

A developer needs to securely store database credentials for a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It integrates natively with Lambda via the AWS Secrets Manager API, allowing the function to retrieve credentials at runtime without hardcoding them, and supports automatic rotation using built-in or custom Lambda rotation functions. This makes it the ideal choice for securely handling database credentials in a serverless application.

Answer

AWS CloudHSM

Answer

AWS KMS

Answer

Amazon DynamoDB

Question 9

A developer is creating an IAM policy to allow a Lambda function to write logs to CloudWatch. Which policy should be attached to the Lambda execution role?

Accepted Answer

AWSLambdaBasicExecutionRole. The AWSLambdaBasicExecutionRole managed policy grants permissions for Lambda to write logs to CloudWatch Logs, specifically allowing the logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents actions. This is the minimal set of permissions required for a Lambda function to send execution logs to CloudWatch, making it the correct choice for this use case.

Answer

AdministratorAccess

Answer

AmazonDynamoDBFullAccess

Answer

AmazonS3FullAccess

Question 10

A developer is troubleshooting an IAM policy that is not working as expected. The policy has an Allow effect for s3:PutObject but the user gets AccessDenied. The user also has a Deny policy attached. What is the most likely reason?

Accepted Answer

An explicit Deny in an IAM policy overrides the Allow. AWS IAM evaluates all policies (identity-based, resource-based, and SCPs) and an explicit Deny always overrides any Allow, regardless of the order in which the policies are written. In this scenario, even though the user has an Allow effect for s3:PutObject, the attached Deny policy explicitly denies the action, resulting in an AccessDenied error. This is a fundamental rule of AWS authorization logic: an explicit Deny cannot be overridden by any Allow.

Answer

The resource-based policy on S3 denies access

Answer

The Allow policy is evaluated before the Deny policy

Answer

An SCP denies the action

Question 11

Which AWS service provides a managed, rotating secret store for database credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is specifically designed to manage the entire lifecycle of secrets, including automatic rotation of database credentials on a configurable schedule (e.g., every 30 days). It natively integrates with Amazon RDS, Aurora, Redshift, and DocumentDB to rotate credentials without application downtime, using a built-in Lambda rotation function. This makes it the only fully managed, rotating secret store among the options.

Answer

AWS KMS

Answer

AWS IAM Roles

Answer

AWS Systems Manager Parameter Store

Question 12

A company wants to encrypt data at rest in Amazon S3 using server-side encryption with KMS (SSE-KMS). They want to ensure that only certain IAM roles can decrypt objects. What must be configured?

Accepted Answer

KMS key policy to allow the IAM roles to decrypt. SSE-KMS uses a customer master key (CMK) to encrypt and decrypt S3 objects. The KMS key policy is the primary access control mechanism for a CMK; it must explicitly grant the IAM roles the kms:Decrypt permission. Without this policy statement, even if the IAM roles have a policy allowing kms:Decrypt, they will be denied access because KMS key policies can override IAM permissions when the key policy does not grant access to the account's IAM principals.

Answer

IAM role policy to allow kms:Decrypt

Answer

S3 bucket policy to allow decrypt

Answer

KMS key policy to allow s3.amazonaws.com to decrypt

Question 13

A developer is creating an IAM policy for an EC2 instance to allow it to read from an S3 bucket. Which of the following are required? (Choose TWO.)

Accepted Answer

Create an IAM role with s3:GetObject permissions. An IAM role is the recommended way to grant temporary, secure credentials to an EC2 instance for accessing AWS services. The s3:GetObject permission allows the instance to read objects from an S3 bucket, which is the specific action required for read access.

Answer

Use KMS to encrypt the S3 objects

Answer

Configure an S3 bucket policy allowing the role

Answer

Create an instance profile and assign a key pair

Question 14

A developer needs to securely expose an API running on an EC2 instance behind an Application Load Balancer. The API should only be accessible to authenticated users via a custom authorization header. Which steps should be taken? (Choose TWO.)

Accepted Answer

Create a Lambda authorizer that validates the custom header. It creates a Lambda authorizer that can validate a custom authorization header. Option D is correct because API Gateway natively supports Lambda authorizers, allowing the custom header validation to secure the API. Options B and C are incorrect because AWS WAF cannot perform custom authorization logic, and Cognito User Pools require OIDC flows, not custom headers. Option E is incorrect because ALB does not natively support Lambda authorizers as a feature.

Answer

Enable AWS WAF on the ALB to inspect the header

Answer

Use Amazon Cognito User Pools to validate the header

Answer

Configure the ALB to use the Lambda authorizer

Question 15

A developer is creating an IAM policy to allow an EC2 instance to read objects from a specific S3 bucket named 'my-app-data'. The policy should be attached to an IAM role that will be assumed by the EC2 instance. Which policy statement meets this requirement?

Accepted Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "arn:aws:s3:::my-app-data/*" } ] }. It grants only the s3:GetObject permission on the specific S3 bucket 'my-app-data' and its objects, which is the minimum required to allow an EC2 instance to read objects from that bucket. The policy is designed to be attached to an IAM role that the EC2 instance assumes, following the principle of least privilege.

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:*", "Resource": "arn:aws:s3:::my-app-data/*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": "s3:GetObject", "Resource": "*" } ] }

Answer

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:PutObject" ], "Resource": "arn:aws:s3:::my-app-data/*" } ] }