DVA-C02 Security Practice Test 27 — 15 Questions

Question 1

A developer is using AWS Certificate Manager (ACM) to provision an SSL/TLS certificate for a website hosted on CloudFront. The certificate must be renewed automatically. What is the correct action?

Accepted Answer

ACM automatically renews the certificate if it uses DNS validation.. ACM automatically renews certificates that use DNS validation, provided the required DNS CNAME record remains in place. CloudFront supports ACM certificates in us-east-1, and ACM handles renewal without any manual intervention or additional infrastructure like Lambda functions.

Answer

The developer must configure a Lambda function to renew the certificate.

Answer

The certificate cannot be used with CloudFront; ACM certificates are only for ALB.

Answer

The developer must manually request a new certificate before expiration.

Question 2

A company wants to encrypt data at rest in Amazon RDS for MySQL. Which TWO actions should be taken?

Accepted Answer

Enable encryption at rest when creating the DB instance.. Amazon RDS for MySQL supports encryption at rest only at the time of DB instance creation. You must enable the encryption option in the console or specify the --storage-encrypted flag in the AWS CLI when launching the instance. Once enabled, RDS automatically encrypts the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, with keys managed through AWS KMS.

Answer

Encrypt individual tables using MySQL native encryption.

Answer

Enable encryption at rest after the DB instance is created.

Answer

Use client-side encryption to encrypt data before sending to RDS.

Question 3

A developer is designing a CI/CD pipeline using AWS CodePipeline. The pipeline deploys a Lambda function. Which THREE practices should be followed to ensure security?

Accepted Answer

Use IAM roles for pipeline actions instead of access keys.. IAM roles provide temporary credentials for AWS services, eliminating the need to manage long-term access keys. CodePipeline can assume an IAM role to perform actions like deploying a Lambda function, which reduces the risk of credential leakage. This follows the principle of least privilege and is a security best practice for automated pipelines.

Answer

Use CloudFront to distribute pipeline artifacts.

Answer

Encrypt artifacts in transit using TLS.

Question 4

Which TWO AWS services can be used to protect an application running on EC2 from common web exploits like SQL injection and cross-site scripting?

Accepted Answer

AWS WAF. AWS WAF is a web application firewall that protects against common web exploits like SQL injection and cross-site scripting by inspecting HTTP(S) requests and blocking malicious patterns. AWS Shield Advanced is a DDoS protection service; it does not directly filter for SQL injection or XSS. Therefore, only AWS WAF is the appropriate service for this specific protection.

Answer

Amazon CloudWatch

Answer

Security Groups

Answer

AWS Shield Advanced

Answer

AWS Identity and Access Management (IAM)

Question 5

A developer runs a CloudTrail lookup command and sees a CreateKey event. What does this event represent?

Accepted Answer

A new KMS customer master key was created.. The `CreateKey` event in AWS CloudTrail indicates that a new KMS customer master key (CMK) was created. This is the only operation that generates a `CreateKey` event; key rotation, database encryption key creation, and service-linked key creation use different API calls (e.g., `RotateKey`, `CreateGrant`, or `CreateKey` with a different service principal).

Answer

An existing KMS key was rotated.

Answer

A new database encryption key was created.

Answer

A new service-linked key was created.

Question 6

A developer is building a serverless application using AWS Lambda and API Gateway. The Lambda function needs to access a DynamoDB table that stores sensitive customer data. The developer wants to follow the principle of least privilege. Which IAM role configuration should be used?

Accepted Answer

Create a custom IAM policy with specific DynamoDB actions (e.g., GetItem, PutItem) on the specific table and attach it to the Lambda execution role.. It adheres to the principle of least privilege by granting only the specific DynamoDB actions (e.g., GetItem, PutItem) required by the Lambda function, scoped to the exact table. The Lambda execution role is an IAM role that the Lambda service assumes, and attaching a custom policy with fine-grained permissions ensures minimal access. This approach avoids over-permissioning and follows AWS security best practices for serverless applications.

Answer

Configure a resource-based policy on the Lambda function to allow DynamoDB access.

Answer

Attach the AmazonDynamoDBFullAccess managed policy to the Lambda execution role.

Answer

Use an S3 bucket policy to grant the Lambda function access to the DynamoDB table.

Question 7

A developer needs to securely store database credentials used by an application running on EC2. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It offers automatic rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in integration, and it encrypts secrets at rest using AWS KMS. For an EC2 application, Secrets Manager can be accessed via the AWS SDK or CLI using IAM roles attached to the EC2 instance, ensuring credentials are never hardcoded or stored in plaintext.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3

Answer

AWS Certificate Manager (ACM)

Question 8

A company wants to allow cross-account access to an S3 bucket in Account A from a role in Account B. The S3 bucket policy in Account A allows the role's ARN. However, access is denied. What is the most likely missing step?

Accepted Answer

The role in Account B must have an IAM policy that allows the S3 actions.. Cross-account S3 access requires both a resource-based policy (the bucket policy in Account A) that grants access to the role ARN, and an identity-based policy (an IAM policy attached to the role in Account B) that explicitly allows the S3 actions. Without the IAM policy in Account B, the role lacks permission to perform the S3 operations, even though the bucket policy permits the access. This is a fundamental principle of AWS cross-account authorization: both the resource side and the principal side must grant the necessary permissions.

Answer

Add a bucket policy that denies access to all principals.

Answer

Disable block public access settings on the bucket.

Answer

Enable ACLs on the S3 bucket.

Question 9

An application running on EC2 needs to access an S3 bucket. The developer has assigned an IAM role to the EC2 instance with a policy that allows s3:GetObject on the bucket. However, the application is still getting access denied errors. What should the developer check?

Accepted Answer

Check the S3 bucket policy for an explicit deny statement that applies to the IAM role.. Even if the IAM role attached to the EC2 instance allows s3:GetObject, an S3 bucket policy with an explicit deny statement that applies to that role will override the allow. IAM policy evaluation logic dictates that an explicit deny in any policy (resource-based or identity-based) takes precedence over any allow, resulting in access denied errors.

Answer

Check that the application is using HTTPS instead of HTTP.

Answer

Check that the EC2 instance has permissions to decrypt the KMS key used by S3.

Answer

Check that the EC2 instance is in the same VPC as the S3 bucket.

Question 10

A developer wants to encrypt data in transit between an API Gateway REST API and its clients. Which configuration should be used?

Accepted Answer

Use the default HTTPS endpoint provided by API Gateway.. API Gateway REST APIs automatically provide an HTTPS endpoint using TLS for data in transit encryption. This default endpoint uses an Amazon-issued certificate, ensuring encryption between clients and API Gateway without any additional configuration. The developer only needs to use the default HTTPS URL provided by API Gateway to satisfy the requirement.

Answer

Use a custom domain name with a certificate from ACM.

Answer

Implement client-side encryption using a JavaScript library.

Answer

Attach an AWS WAF web ACL to the API Gateway.

Question 11

A Lambda function needs to write logs to CloudWatch Logs. The developer attaches an IAM role with a policy that allows logs:CreateLogGroup and logs:PutLogEvents. However, logs are not appearing. What is the most likely cause?

Accepted Answer

The IAM policy does not include logs:CreateLogStream.. Lambda requires the `logs:CreateLogStream` permission to create a log stream within a log group before it can write log events. Without this permission, the function can create the log group but cannot create the individual log stream needed to store log entries, causing logs to silently fail to appear.

Answer

The Lambda function is not configured to use a VPC.

Answer

The IAM role does not have a trust policy that allows Lambda to assume it.

Answer

The CloudWatch Logs log group does not exist.

Question 12

A developer needs to generate temporary credentials for a user to access an S3 bucket for 30 minutes. Which AWS service should be used?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the correct service for generating temporary, limited-privilege credentials to access AWS resources. It can issue credentials with a configurable expiration period, such as 30 minutes, via the AssumeRole API call. This directly meets the requirement for time-bound access to an S3 bucket.

Answer

IAM role

Answer

Amazon Cognito

Answer

AWS Key Management Service (KMS)

Question 13

A company is implementing a CI/CD pipeline using AWS CodePipeline and CodeBuild. The pipeline deploys a serverless application. Which TWO actions should be taken to securely manage the database credentials used by the application?

Accepted Answer

Use AWS Lambda environment variables with encryption using a KMS key.. AWS Lambda environment variables can be encrypted at rest using a KMS key, providing a secure way to store sensitive data like database credentials without hardcoding them in the function code. This approach ensures that the credentials are decrypted only when the Lambda function executes, and access to the KMS key can be controlled via IAM policies. Option E is also correct because AWS Secrets Manager is a dedicated service for managing secrets throughout their lifecycle, and CodeBuild can retrieve them securely using an IAM role with appropriate permissions, eliminating the need to store secrets in code or configuration files.

Answer

Embed the credentials in the Lambda function code.

Answer

Store the credentials in the buildspec.yml file in the CodeCommit repository.

Answer

Pass the credentials as CloudFormation parameters during deployment.

Question 14

A developer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. Which TWO additional checks should the developer perform to resolve the issue?

Accepted Answer

Check if the S3 bucket policy has an explicit deny statement that affects the EC2 instance.. S3 bucket policies can explicitly deny access even if the IAM role attached to the EC2 instance grants s3:GetObject. An explicit deny in a bucket policy overrides any allow, so checking for such a deny statement is essential. Option E is correct because if the S3 bucket uses SSE-KMS encryption, the EC2 instance's IAM role must have kms:Decrypt permissions to decrypt the object; without it, GetObject requests will fail.

Answer

Check the network ACLs for the subnet.

Answer

Check if the EC2 instance is in a VPC with an S3 VPC endpoint configured.

Answer

Check the security group rules attached to the EC2 instance.

Question 15

A company is using AWS Lambda functions that access an RDS database. Which THREE practices should be followed to secure the database credentials?

Accepted Answer

Use AWS Secrets Manager to store and automatically rotate the credentials.. Option A is correct because AWS Secrets Manager is purpose-built to store database credentials securely and can automatically rotate RDS credentials on a schedule using a Lambda rotation function, eliminating hard-coded or long-lived secrets. Option C is correct because Lambda environment variables can be encrypted at rest with an AWS KMS customer managed key, so credentials are not stored in plaintext and the function decrypts them at runtime using its execution role permissions. Option E is correct because placing the Lambda function in the same VPC as the RDS instance and using a security group to permit traffic only to the database port (e.g., 3306 for MySQL or 5432 for PostgreSQL) restricts network access to the database. Option B is incorrect because security groups are stateful virtual firewalls that filter network traffic; they do not decrypt credentials. Option D is incorrect because embedding credentials in Lambda function code exposes them in source control, deployment packages, and logs, which is an insecure anti-pattern.

Answer

Use a security group to decrypt the credentials.

Answer

Store the credentials in the Lambda function code.