DVA-C02 Security Practice Test 27 — 15 Questions

Question 1

A company runs a web application on EC2 instances behind an Application Load Balancer. The application uses a PostgreSQL database on RDS. The security team requires that database credentials never be stored in application code or configuration files. Which solution meets this requirement?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use AWS Secrets Manager to store the credentials and retrieve them at runtime with automatic rotation.. AWS Secrets Manager is designed specifically for securely storing and automatically rotating database credentials. It integrates natively with RDS for PostgreSQL, enabling automatic rotation without code changes. The application retrieves credentials at runtime via the AWS SDK, ensuring they are never stored in code or configuration files.

Answer

Store the credentials in a Systems Manager Parameter Store parameter and retrieve them at application startup.

Answer

Store the credentials in an encrypted S3 bucket and have the application read the config file at startup.

Answer

Hardcode the credentials in a Lambda function that is called to get the credentials.

Question 2

A company wants to encrypt data in transit between an Application Load Balancer and its EC2 instances. The instances run a custom web server. Which configuration should the developer implement?

Accepted Answer

Configure the ALB listener with a TLS certificate and set the target group protocol to HTTPS. Install the server certificate on the EC2 instances.. To encrypt data in transit between an Application Load Balancer (ALB) and EC2 instances, the ALB listener must be configured with a TLS certificate for client-to-ALB encryption, and the target group protocol must be set to HTTPS to enable encryption between the ALB and the instances. The EC2 instances must have a server certificate installed (e.g., from ACM or self-signed) to terminate the TLS connection, ensuring end-to-end encryption. This setup allows the ALB to re-encrypt traffic after decrypting it from the client, using HTTPS for the backend connection.

Answer

Use AWS Certificate Manager to issue a certificate for the EC2 instances and configure the web server to use it.

Answer

Configure the ALB listener with a TLS certificate and set the target group protocol to HTTP.

Answer

Enable client certificate authentication on the ALB.

Question 3

A developer needs to grant cross-account access to an S3 bucket owned by Account A to a user in Account B. Which approach is the most secure?

Accepted Answer

Add a bucket policy in Account A that grants access to the user in Account B, and attach an IAM policy to the user in Account B allowing the S3 actions.. The most secure because it combines a resource-based bucket policy in Account A that explicitly grants access to the user in Account B with an identity-based IAM policy attached to that user in Account B. This dual-policy approach ensures that the user can only access the bucket when both policies allow the action, following the principle of least privilege and avoiding the need to share long-term credentials.

Answer

Create an IAM role in Account A with a trust policy allowing the user from Account B to assume it.

Answer

Share the access keys of an IAM user in Account A with the user in Account B.

Answer

Attach an IAM policy to the user in Account B that grants access to the S3 bucket.

Question 4

Refer to the exhibit. A developer deploys this CloudFormation template. The Lambda function needs to write objects to an S3 bucket named 'my-app-bucket'. What must the developer add to the template?

Accepted Answer

Add a new policy statement to LambdaExecutionRole allowing 's3:PutObject' on 'arn:aws:s3:::my-app-bucket/*'.. The Lambda function requires an IAM policy attached to its execution role to grant permissions for specific S3 actions. The `s3:PutObject` action on the `arn:aws:s3:::my-app-bucket/*` resource ARN precisely allows writing objects to the bucket, following the principle of least privilege. Without this policy statement, the Lambda function will receive an access denied error when trying to write to S3.

Answer

Add an S3 bucket policy allowing the Lambda function's ARN to write objects.

Answer

Add a policy statement to LambdaExecutionRole allowing 's3:*' on 'arn:aws:s3:::my-app-bucket'.

Answer

Add a KMS key policy to allow the Lambda function to use a customer managed key.

Question 5

A developer is deploying an application that uses Amazon SQS queues. The messages contain sensitive data that must be encrypted at rest. Which TWO actions should the developer take? (Choose TWO.)

Accepted Answer

Configure the SQS queue to use a customer managed KMS key.. Configuring an SQS queue to use a customer managed KMS key gives you control over the key lifecycle, including rotation and access policies, while still leveraging AWS KMS for server-side encryption. Option D is also correct because enabling server-side encryption (SSE) for SQS using AWS KMS encrypts messages at rest automatically, without requiring client-side changes. Together, these two actions ensure that sensitive data in SQS messages is encrypted at rest using KMS, meeting the requirement.

Answer

Encrypt the messages client-side before sending to SQS.

Answer

Store the messages in an S3 bucket with default encryption instead of using SQS.

Answer

Use AWS CloudHSM to generate and store the encryption keys.

Question 6

A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role's trust policy allows the EC2 service, and the permissions policy grants s3:GetObject on the bucket. The application on the instance receives 'Access Denied' errors when trying to read objects. What is the most likely cause?

Accepted Answer

The EC2 instance does not have an instance profile associated with the IAM role.. The most likely cause is that the EC2 instance does not have an instance profile associated with the IAM role. An IAM role must be attached to an EC2 instance via an instance profile, which acts as a container for the role. Without this association, the instance cannot obtain temporary credentials from the AWS Security Token Service (STS) to sign API requests, resulting in 'Access Denied' errors even if the role's trust and permissions policies are correctly configured.

Answer

The IAM role's trust policy does not allow the EC2 service.

Answer

The S3 bucket has default encryption enabled.

Answer

The S3 bucket policy explicitly denies s3:GetObject.

Question 7

A developer is building a serverless application using AWS Lambda functions that need to read and write to an Amazon DynamoDB table. What is the best practice for granting the Lambda function access to DynamoDB?

Accepted Answer

Create an IAM role with a trust policy that allows Lambda to assume it, and attach a permissions policy granting DynamoDB access.. AWS Lambda functions require an IAM role (execution role) with a trust policy that allows Lambda to assume it, and a permissions policy that grants the necessary DynamoDB actions (e.g., GetItem, PutItem). This is the standard and secure method for granting permissions to Lambda, as it avoids hardcoding credentials and follows the principle of least privilege.

Answer

Create an IAM user and store the access keys in the Lambda environment variables.

Answer

Attach a resource-based policy to the Lambda function that grants DynamoDB access.

Answer

Use the Lambda function's default VPC role to access DynamoDB via a VPC endpoint.

Question 8

A company is designing a multi-account strategy using AWS Organizations. They want to enable cross-account access for developers using IAM roles. Each developer has an IAM user in the 'developers' account. The 'production' account has an IAM role 'AdminRole' that can be assumed by the 'developers' account. Which trust policy should be attached to 'AdminRole'?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:root"},"Action":"sts:AssumeRole"}]} where 123456789012 is the developers account ID.. The trust policy on the 'AdminRole' in the production account must allow the entire 'developers' account (using its root ARN) to assume the role. When an IAM user in the developers account calls sts:AssumeRole, AWS evaluates the trust policy; specifying the root ARN of the developers account (arn:aws:iam::123456789012:root) delegates trust to the entire account, and the individual user's permissions are then controlled by an IAM policy attached to the user or a group that grants sts:AssumeRole for this role.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"Service":"ec2.amazonaws.com"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:user/*"},"Action":"sts:AssumeRole"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Principal":{"AWS":"arn:aws:iam::123456789012:role/AdminRole"},"Action":"sts:AssumeRole"}]}

Question 9

A developer is using AWS Secrets Manager to store database credentials. The application runs on EC2 and needs to retrieve the secret. Which approach is the most secure?

Accepted Answer

Use an IAM role attached to the EC2 instance with permissions to access the secret, and call the AWS SDK to retrieve it at runtime.. It follows the principle of least privilege and avoids hardcoding or storing secrets in insecure locations. By attaching an IAM role to the EC2 instance, the application can securely retrieve the secret from AWS Secrets Manager at runtime using the AWS SDK, without ever exposing the secret in code, configuration files, or environment variables. This approach leverages IAM's temporary credentials from the instance metadata service (IMDS) to authenticate the SDK call, ensuring the secret is never persisted locally.

Answer

Store the secret in an environment variable in the user data script.

Answer

Retrieve the secret at application startup and store it in a configuration file.

Answer

Download the secret from an S3 bucket using pre-signed URLs.

Question 10

A company uses AWS KMS to encrypt data in Amazon S3. They have a Customer Master Key (CMK) with key rotation enabled. The S3 bucket has default encryption using SSE-KMS with this CMK. An application writes objects to the bucket. Which statement about the encryption is correct?

Accepted Answer

The CMK is used to generate a data key that encrypts the object, and the encrypted data key is stored with the object.. AWS KMS uses envelope encryption: when an object is written to S3 with SSE-KMS, KMS generates a unique data key from the CMK, encrypts the object with that data key, and then stores the encrypted data key alongside the object in S3. The CMK itself never directly encrypts the object data; it only encrypts the data key. This ensures that the CMK can be rotated without affecting the encrypted objects, as the encrypted data key remains decryptable by the new key material if the key ID is the same.

Answer

The CMK directly encrypts the object data.

Answer

When the CMK is rotated, all existing objects in the bucket are automatically re-encrypted with the new key.

Answer

Each object is encrypted with a unique data key that is stored alongside the object.

Question 11

A developer needs to grant an IAM user in Account A access to an S3 bucket in Account B. What is the correct combination of policies?

Accepted Answer

An IAM policy in Account A allowing access to the S3 bucket, and a bucket policy in Account B allowing the IAM user.. Cross-account S3 access requires two policies: an IAM policy in the source account (Account A) granting the user permission to perform S3 actions on the bucket, and a bucket policy in the target account (Account B) that explicitly allows the IAM user's ARN. The bucket policy acts as a resource-based policy that delegates access to the external principal, while the IAM policy authorizes the user to make the request. Without both, the request will be denied by either the source account's implicit deny or the target account's default deny.

Answer

An S3 bucket policy in Account B that allows the IAM user's ARN.

Answer

An IAM policy in Account A allowing access, and a bucket ACL in Account B granting access to the IAM user.

Answer

Create an IAM role in Account B that the user can assume, and attach a bucket policy allowing the role.

Question 12

An application uses Amazon Cognito user pools for authentication. A developer wants to restrict access to an API Gateway endpoint to only authenticated users from a specific user pool. What is the best approach?

Accepted Answer

Use a Cognito User Pool authorizer in API Gateway.. A Cognito User Pool authorizer in API Gateway is the native, fully managed way to restrict access to an API endpoint to authenticated users from a specific user pool. It automatically validates the JWT token issued by the user pool and caches the result, requiring no custom code. This approach integrates directly with API Gateway's authorization flow, ensuring only tokens from the specified user pool are accepted.

Answer

Attach an IAM policy to the API Gateway resource that allows only the Cognito user pool ARN.

Answer

Use an API Gateway resource policy that allows access only from the Cognito user pool.

Answer

Use a Lambda authorizer that validates the JWT token against the user pool.

Question 13

A developer is using AWS Certificate Manager (ACM) to provision an SSL/TLS certificate for a website hosted on CloudFront. The certificate must be renewed automatically. What is the correct action?

Accepted Answer

ACM automatically renews the certificate if it uses DNS validation.. ACM automatically renews certificates that use DNS validation, provided the required DNS CNAME record remains in place. CloudFront supports ACM certificates in us-east-1, and ACM handles renewal without any manual intervention or additional infrastructure like Lambda functions.

Answer

The developer must configure a Lambda function to renew the certificate.

Answer

The certificate cannot be used with CloudFront; ACM certificates are only for ALB.

Answer

The developer must manually request a new certificate before expiration.

Question 14

A company wants to encrypt data at rest in Amazon RDS for MySQL. Which TWO actions should be taken?

Accepted Answer

Enable encryption at rest when creating the DB instance.. Amazon RDS for MySQL supports encryption at rest only at the time of DB instance creation. You must enable the encryption option in the console or specify the --storage-encrypted flag in the AWS CLI when launching the instance. Once enabled, RDS automatically encrypts the underlying storage, automated backups, read replicas, and snapshots using AES-256 encryption, with keys managed through AWS KMS.

Answer

Encrypt individual tables using MySQL native encryption.

Answer

Enable encryption at rest after the DB instance is created.

Answer

Use client-side encryption to encrypt data before sending to RDS.

Question 15

A developer runs a CloudTrail lookup command and sees a CreateKey event. What does this event represent?

Accepted Answer

A new KMS customer master key was created.. The `CreateKey` event in AWS CloudTrail indicates that a new KMS customer master key (CMK) was created. This is the only operation that generates a `CreateKey` event; key rotation, database encryption key creation, and service-linked key creation use different API calls (e.g., `RotateKey`, `CreateGrant`, or `CreateKey` with a different service principal).

Answer

An existing KMS key was rotated.

Answer

A new database encryption key was created.

Answer

A new service-linked key was created.