DVA-C02 Security Practice Test 27 — 15 Questions

Question 1

A company wants to allow cross-account access to an S3 bucket in Account A from a role in Account B. The S3 bucket policy in Account A allows the role's ARN. However, access is denied. What is the most likely missing step?

Accepted Answer

The role in Account B must have an IAM policy that allows the S3 actions.. Option B is correct because cross-account S3 access requires both a resource-based policy (the bucket policy in Account A) that grants access to the role ARN, and an identity-based policy (an IAM policy attached to the role in Account B) that explicitly allows the S3 actions. Without the IAM policy in Account B, the role lacks permission to perform the S3 operations, even though the bucket policy permits the access. This is a fundamental principle of AWS cross-account authorization: both the resource side and the principal side must grant the necessary permissions.

Answer

Add a bucket policy that denies access to all principals.

Answer

Disable block public access settings on the bucket.

Answer

Enable ACLs on the S3 bucket.

Question 2

An application running on EC2 needs to access an S3 bucket. The developer has assigned an IAM role to the EC2 instance with a policy that allows s3:GetObject on the bucket. However, the application is still getting access denied errors. What should the developer check?

Accepted Answer

Check the S3 bucket policy for an explicit deny statement that applies to the IAM role.. Option B is correct because even if the IAM role attached to the EC2 instance allows s3:GetObject, an S3 bucket policy with an explicit deny statement that applies to that role will override the allow. IAM policy evaluation logic dictates that an explicit deny in any policy (resource-based or identity-based) takes precedence over any allow, resulting in access denied errors.

Answer

Check that the application is using HTTPS instead of HTTP.

Answer

Check that the EC2 instance has permissions to decrypt the KMS key used by S3.

Answer

Check that the EC2 instance is in the same VPC as the S3 bucket.

Question 3

A developer wants to encrypt data in transit between an API Gateway REST API and its clients. Which configuration should be used?

Accepted Answer

Use the default HTTPS endpoint provided by API Gateway.. Option C is correct because API Gateway REST APIs automatically provide an HTTPS endpoint using TLS for data in transit encryption. This default endpoint uses an Amazon-issued certificate, ensuring encryption between clients and API Gateway without any additional configuration. The developer only needs to use the default HTTPS URL provided by API Gateway to satisfy the requirement.

Answer

Use a custom domain name with a certificate from ACM.

Answer

Implement client-side encryption using a JavaScript library.

Answer

Attach an AWS WAF web ACL to the API Gateway.

Question 4

A company is using AWS CodeCommit and wants to ensure that all commits are signed with a GPG key. What must the developer configure?

Accepted Answer

Create a repository policy that requires commits to be signed.. Option D is correct because AWS CodeCommit supports repository policies that can enforce commit signing using the 'refs/heads/' condition key with 'git:Signer' or 'git:CommitSigningRequired' to require that all commits pushed to the repository are signed with a valid GPG key. This policy is evaluated at push time, and if a commit is not signed, the push is rejected, ensuring compliance without relying on developer discipline.

Answer

Ask developers to sign commits using git commit -S.

Answer

Configure an SSH key in the IAM user.

Answer

Use HTTPS with a password.

Question 5

A Lambda function needs to write logs to CloudWatch Logs. The developer attaches an IAM role with a policy that allows logs:CreateLogGroup and logs:PutLogEvents. However, logs are not appearing. What is the most likely cause?

Accepted Answer

The IAM policy does not include logs:CreateLogStream.. Lambda requires the `logs:CreateLogStream` permission to create a log stream within a log group before it can write log events. Without this permission, the function can create the log group but cannot create the individual log stream needed to store log entries, causing logs to silently fail to appear.

Answer

The Lambda function is not configured to use a VPC.

Answer

The IAM role does not have a trust policy that allows Lambda to assume it.

Answer

The CloudWatch Logs log group does not exist.

Question 6

A developer needs to generate temporary credentials for a user to access an S3 bucket for 30 minutes. Which AWS service should be used?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the correct service for generating temporary, limited-privilege credentials to access AWS resources. It can issue credentials with a configurable expiration period, such as 30 minutes, via the AssumeRole API call. This directly meets the requirement for time-bound access to an S3 bucket.

Answer

IAM role

Answer

Amazon Cognito

Answer

AWS Key Management Service (KMS)

Question 7

A company is implementing a CI/CD pipeline using AWS CodePipeline and CodeBuild. The pipeline deploys a serverless application. Which TWO actions should be taken to securely manage the database credentials used by the application?

Accepted Answer

Use AWS Lambda environment variables with encryption using a KMS key.. Option D is correct because AWS Lambda environment variables can be encrypted at rest using a KMS key, providing a secure way to store sensitive data like database credentials without hardcoding them in the function code. This approach ensures that the credentials are decrypted only when the Lambda function executes, and access to the KMS key can be controlled via IAM policies. Option E is also correct because AWS Secrets Manager is a dedicated service for managing secrets throughout their lifecycle, and CodeBuild can retrieve them securely using an IAM role with appropriate permissions, eliminating the need to store secrets in code or configuration files.

Answer

Embed the credentials in the Lambda function code.

Answer

Store the credentials in the buildspec.yml file in the CodeCommit repository.

Answer

Pass the credentials as CloudFormation parameters during deployment.

Question 8

A developer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. Which TWO additional checks should the developer perform to resolve the issue?

Accepted Answer

Check if the S3 bucket policy has an explicit deny statement that affects the EC2 instance.. Option B is correct because S3 bucket policies can explicitly deny access even if the IAM role attached to the EC2 instance grants s3:GetObject. An explicit deny in a bucket policy overrides any allow, so checking for such a deny statement is essential. Option E is correct because if the S3 bucket uses SSE-KMS encryption, the EC2 instance's IAM role must have kms:Decrypt permissions to decrypt the object; without it, GetObject requests will fail.

Answer

Check the network ACLs for the subnet.

Answer

Check if the EC2 instance is in a VPC with an S3 VPC endpoint configured.

Answer

Check the security group rules attached to the EC2 instance.

Question 9

A company is using AWS Lambda functions that access an RDS database. Which THREE practices should be followed to secure the database credentials?

Accepted Answer

Use AWS Secrets Manager to store and automatically rotate the credentials.. Option A is correct because AWS Secrets Manager is designed to securely store, retrieve, and automatically rotate database credentials, eliminating the need to hardcode secrets. It integrates natively with RDS to manage credential rotation on a schedule you define, reducing the risk of credential exposure. This follows the AWS security best practice of using a dedicated secrets management service rather than embedding credentials in code or configuration.

Answer

Use a security group to decrypt the credentials.

Answer

Store the credentials in the Lambda function code.

Question 10

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted using SSE-KMS with a specific KMS key from the central security account. They also want to prevent any unencrypted bucket creation. A developer in the development account creates a new S3 bucket and enables default encryption using SSE-S3. The bucket creation succeeds, but the security team wants to prevent this. The developer argues that the bucket still encrypts data at rest. Compliance requires SSE-KMS only. What should the security team do to enforce this policy across all accounts?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutObject and s3:PutBucketEncryption unless the encryption is SSE-KMS with the specific KMS key.. Option D is correct because a service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny S3 bucket creation and encryption configuration unless SSE-KMS with the specific KMS key is used. SCPs affect all accounts in the organization, preventing developers from bypassing the policy by creating buckets with SSE-S3, as the SCP condition key `s3:x-amz-server-side-encryption` and `s3:x-amz-server-side-encryption-aws-kms-key-id` enforce the required encryption at the API level before the bucket is created.

Answer

Create an IAM policy in the central security account that denies s3:PutBucketEncryption if the encryption is not SSE-KMS.

Answer

Use AWS Config to detect non-compliant buckets and automatically apply default encryption with SSE-KMS.

Answer

Enable CloudTrail to log all S3 API calls and manually review for non-compliant buckets.

Question 11

A developer is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application uses HTTPS. The developer creates a certificate in AWS Certificate Manager (ACM) and associates it with the ALB listener on port 443. However, when users access the application, they receive a browser warning that the connection is not secure. The ALB is configured with a default SSL/TLS policy. What is the most likely cause of the issue?

Accepted Answer

The certificate is in a different region than the ALB.. ACM certificates are region-specific. If the certificate is created in a different AWS region than the ALB, the ALB cannot use it, causing the browser to warn that the connection is not secure. The ALB will fall back to its default self-signed certificate or no valid certificate, triggering the browser warning.

Answer

The certificate was not imported correctly into ACM.

Answer

The ALB is using an outdated SSL/TLS policy.

Answer

The ALB cannot terminate HTTPS; the developer must configure HTTPS on the EC2 instances.

Question 12

A company has a centralized logging solution where all EC2 instances send logs to a CloudWatch Logs group in a central account. The EC2 instances are in a different account (App Account). The developer configures the CloudWatch agent on the instances with the necessary IAM role. However, logs are not appearing in the central account's log group. The IAM role in the App Account has permissions to put logs to the central account's log group. What is the most likely missing configuration?

Accepted Answer

The central account's log group must have a resource-based policy that grants the App Account's IAM role permissions to put logs.. Option A is correct because cross-account CloudWatch Logs requires a destination policy in the central account that allows the App Account to write logs. Option B is wrong because VPC endpoints are not required. Option C is wrong because the log group does not need to be in the same region, but cross-region might require additional configuration. Option D is wrong because KMS encryption is optional.

Answer

CloudWatch Logs must be encrypted with the same KMS key in both accounts.

Answer

The log group must be in the same region as the EC2 instances.

Answer

The EC2 instances must be in a VPC with a VPC endpoint for CloudWatch Logs.

Question 13

A company uses an S3 bucket to store sensitive customer data. The bucket policy currently allows access to a specific IAM role used by an EC2 instance. A security audit reveals that the bucket is also accessible from an external AWS account. Which action should the security team take to restrict access to only the intended role?

Accepted Answer

Add a condition in the bucket policy to allow access only when the request includes the specific IAM role ARN.. Option D is correct because adding a condition in the bucket policy using the `aws:PrincipalArn` condition key allows you to restrict access exclusively to the specific IAM role ARN. This ensures that even if the bucket policy grants access to an external AWS account, only requests made by the designated IAM role (e.g., `arn:aws:iam::123456789012:role/EC2AppRole`) will be allowed, effectively blocking any other principals, including those from external accounts.

Answer

Use S3 Object Ownership to disable ACLs.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Modify the IAM role trust policy to only allow the EC2 instance.

Question 14

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. However, the application receives an AccessDenied error. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AppRole"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

The EC2 instance is using the correct IAM role. What is the most likely cause of the error?

Accepted Answer

The IAM role attached to the EC2 instance has a different ARN than the one specified in the bucket policy.. Option C is correct because the bucket policy explicitly allows only the role with the exact ARN 'arn:aws:iam::123456789012:role/AppRole'. If the instance's role ARN is different, the request is denied. Option A is wrong because S3 does not require SSE for GetObject. Option B is wrong because MFA is not specified in the error. Option D is wrong because IAM role policies and bucket policies are evaluated separately; an allow in the bucket policy must match the principal.

Answer

The bucket uses default encryption with SSE-S3, and the application does not support it.

Answer

The IAM role policy allows s3:GetObject, but the bucket policy also must allow it, which it does.

Answer

The bucket policy requires MFA, but the application does not provide it.

Question 15

A developer needs to securely store database credentials for a Lambda function. The credentials should be automatically rotated every 30 days. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports native rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in Lambda rotation functions, and can be configured to rotate on a schedule (e.g., every 30 days) without custom code. The service also integrates directly with Lambda via the AWS SDK to retrieve secrets at runtime, ensuring credentials are never hardcoded.

Answer

AWS Key Management Service (KMS) to encrypt the credentials.

Answer

Store the credentials in an IAM role's trust policy.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.