DVA-C02 Security Practice Test 28 — 15 Questions

Question 1

A developer is building a serverless application using AWS Lambda and API Gateway. The Lambda function needs to access a DynamoDB table that stores sensitive customer data. The developer wants to follow the principle of least privilege. Which IAM role configuration should be used?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a custom IAM policy with specific DynamoDB actions (e.g., GetItem, PutItem) on the specific table and attach it to the Lambda execution role.. It adheres to the principle of least privilege by granting only the specific DynamoDB actions (e.g., GetItem, PutItem) required by the Lambda function, scoped to the exact table. The Lambda execution role is an IAM role that the Lambda service assumes, and attaching a custom policy with fine-grained permissions ensures minimal access. This approach avoids over-permissioning and follows AWS security best practices for serverless applications.

Answer

Configure a resource-based policy on the Lambda function to allow DynamoDB access.

Answer

Attach the AmazonDynamoDBFullAccess managed policy to the Lambda execution role.

Answer

Use an S3 bucket policy to grant the Lambda function access to the DynamoDB table.

Question 2

A developer needs to securely store database credentials used by an application running on EC2. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It offers automatic rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in integration, and it encrypts secrets at rest using AWS KMS. For an EC2 application, Secrets Manager can be accessed via the AWS SDK or CLI using IAM roles attached to the EC2 instance, ensuring credentials are never hardcoded or stored in plaintext.

Answer

AWS Systems Manager Parameter Store

Answer

Amazon S3

Answer

AWS Certificate Manager (ACM)

Question 3

A company wants to allow cross-account access to an S3 bucket in Account A from a role in Account B. The S3 bucket policy in Account A allows the role's ARN. However, access is denied. What is the most likely missing step?

Accepted Answer

The role in Account B must have an IAM policy that allows the S3 actions.. Cross-account S3 access requires both a resource-based policy (the bucket policy in Account A) that grants access to the role ARN, and an identity-based policy (an IAM policy attached to the role in Account B) that explicitly allows the S3 actions. Without the IAM policy in Account B, the role lacks permission to perform the S3 operations, even though the bucket policy permits the access. This is a fundamental principle of AWS cross-account authorization: both the resource side and the principal side must grant the necessary permissions.

Answer

Add a bucket policy that denies access to all principals.

Answer

Disable block public access settings on the bucket.

Answer

Enable ACLs on the S3 bucket.

Question 4

An application running on EC2 needs to access an S3 bucket. The developer has assigned an IAM role to the EC2 instance with a policy that allows s3:GetObject on the bucket. However, the application is still getting access denied errors. What should the developer check?

Accepted Answer

Check the S3 bucket policy for an explicit deny statement that applies to the IAM role.. Even if the IAM role attached to the EC2 instance allows s3:GetObject, an S3 bucket policy with an explicit deny statement that applies to that role will override the allow. IAM policy evaluation logic dictates that an explicit deny in any policy (resource-based or identity-based) takes precedence over any allow, resulting in access denied errors.

Answer

Check that the application is using HTTPS instead of HTTP.

Answer

Check that the EC2 instance has permissions to decrypt the KMS key used by S3.

Answer

Check that the EC2 instance is in the same VPC as the S3 bucket.

Question 5

A developer wants to encrypt data in transit between an API Gateway REST API and its clients. Which configuration should be used?

Accepted Answer

Use the default HTTPS endpoint provided by API Gateway.. API Gateway REST APIs automatically provide an HTTPS endpoint using TLS for data in transit encryption. This default endpoint uses an Amazon-issued certificate, ensuring encryption between clients and API Gateway without any additional configuration. The developer only needs to use the default HTTPS URL provided by API Gateway to satisfy the requirement.

Answer

Use a custom domain name with a certificate from ACM.

Answer

Implement client-side encryption using a JavaScript library.

Answer

Attach an AWS WAF web ACL to the API Gateway.

Question 6

A Lambda function needs to write logs to CloudWatch Logs. The developer attaches an IAM role with a policy that allows logs:CreateLogGroup and logs:PutLogEvents. However, logs are not appearing. What is the most likely cause?

Accepted Answer

The IAM policy does not include logs:CreateLogStream.. Lambda requires the `logs:CreateLogStream` permission to create a log stream within a log group before it can write log events. Without this permission, the function can create the log group but cannot create the individual log stream needed to store log entries, causing logs to silently fail to appear.

Answer

The Lambda function is not configured to use a VPC.

Answer

The IAM role does not have a trust policy that allows Lambda to assume it.

Answer

The CloudWatch Logs log group does not exist.

Question 7

A developer needs to generate temporary credentials for a user to access an S3 bucket for 30 minutes. Which AWS service should be used?

Accepted Answer

AWS Security Token Service (STS). AWS Security Token Service (STS) is the correct service for generating temporary, limited-privilege credentials to access AWS resources. It can issue credentials with a configurable expiration period, such as 30 minutes, via the AssumeRole API call. This directly meets the requirement for time-bound access to an S3 bucket.

Answer

IAM role

Answer

Amazon Cognito

Answer

AWS Key Management Service (KMS)

Question 8

A company is implementing a CI/CD pipeline using AWS CodePipeline and CodeBuild. The pipeline deploys a serverless application. Which TWO actions should be taken to securely manage the database credentials used by the application?

Accepted Answer

Use AWS Lambda environment variables with encryption using a KMS key.. AWS Lambda environment variables can be encrypted at rest using a KMS key, providing a secure way to store sensitive data like database credentials without hardcoding them in the function code. This approach ensures that the credentials are decrypted only when the Lambda function executes, and access to the KMS key can be controlled via IAM policies. Option E is also correct because AWS Secrets Manager is a dedicated service for managing secrets throughout their lifecycle, and CodeBuild can retrieve them securely using an IAM role with appropriate permissions, eliminating the need to store secrets in code or configuration files.

Answer

Embed the credentials in the Lambda function code.

Answer

Store the credentials in the buildspec.yml file in the CodeCommit repository.

Answer

Pass the credentials as CloudFormation parameters during deployment.

Question 9

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted using SSE-KMS with a specific KMS key from the central security account. They also want to prevent any unencrypted bucket creation. A developer in the development account creates a new S3 bucket and enables default encryption using SSE-S3. The bucket creation succeeds, but the security team wants to prevent this. The developer argues that the bucket still encrypts data at rest. Compliance requires SSE-KMS only. What should the security team do to enforce this policy across all accounts?

Accepted Answer

Create a service control policy (SCP) that denies s3:PutObject and s3:PutBucketEncryption unless the encryption is SSE-KMS with the specific KMS key.. A service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny S3 bucket creation and encryption configuration unless SSE-KMS with the specific KMS key is used. SCPs affect all accounts in the organization, preventing developers from bypassing the policy by creating buckets with SSE-S3, as the SCP condition key `s3:x-amz-server-side-encryption` and `s3:x-amz-server-side-encryption-aws-kms-key-id` enforce the required encryption at the API level before the bucket is created.

Answer

Create an IAM policy in the central security account that denies s3:PutBucketEncryption if the encryption is not SSE-KMS.

Answer

Use AWS Config to detect non-compliant buckets and automatically apply default encryption with SSE-KMS.

Answer

Enable CloudTrail to log all S3 API calls and manually review for non-compliant buckets.

Question 10

A company uses an S3 bucket to store sensitive customer data. The bucket policy currently allows access to a specific IAM role used by an EC2 instance. A security audit reveals that the bucket is also accessible from an external AWS account. Which action should the security team take to restrict access to only the intended role?

Accepted Answer

Add a condition in the bucket policy to allow access only when the request includes the specific IAM role ARN.. Adding a condition in the bucket policy using the `aws:PrincipalArn` condition key allows you to restrict access exclusively to the specific IAM role ARN. This ensures that even if the bucket policy grants access to an external AWS account, only requests made by the designated IAM role (e.g., `arn:aws:iam::123456789012:role/EC2AppRole`) will be allowed, effectively blocking any other principals, including those from external accounts.

Answer

Use S3 Object Ownership to disable ACLs.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Modify the IAM role trust policy to only allow the EC2 instance.

Question 11

A developer needs to securely store database credentials for a Lambda function. The credentials should be automatically rotated every 30 days. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports native rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in Lambda rotation functions, and can be configured to rotate on a schedule (e.g., every 30 days) without custom code. The service also integrates directly with Lambda via the AWS SDK to retrieve secrets at runtime, ensuring credentials are never hardcoded.

Answer

AWS Key Management Service (KMS) to encrypt the credentials.

Answer

Store the credentials in an IAM role's trust policy.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Question 12

A company uses an AWS Lambda function to process files uploaded to an S3 bucket. The Lambda function needs to read the files and write results to a DynamoDB table. The Lambda function is configured with an IAM role that has policies allowing s3:GetObject on the bucket and dynamodb:PutItem on the table. Despite correct permissions, the function fails with an AccessDenied error when trying to put items. What is the most likely cause?

Accepted Answer

The DynamoDB table has a resource-based policy that explicitly denies access to the Lambda function's IAM role.. DynamoDB tables can have resource-based policies that explicitly deny access even if the IAM role has the necessary permissions. Since explicit denies in resource-based policies override any allow in identity-based policies, the Lambda function's IAM role with dynamodb:PutItem permission is still blocked, causing the AccessDenied error.

Answer

The Lambda function is in a VPC without a VPC endpoint for DynamoDB.

Answer

The S3 bucket is in a different region, causing cross-region access issues.

Answer

The DynamoDB table is encrypted with a customer managed KMS key, and the Lambda role does not have kms:Decrypt permission.

Question 13

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AES-256 using SSE-S3. They also want to automatically remediate any bucket that is created without encryption. The team currently uses AWS CloudFormation StackSets to deploy resources. They need a solution that does not require manual intervention. Which approach should be taken?

Accepted Answer

Configure an AWS Config rule to detect buckets without SSE-S3 and use AWS Systems Manager Automation to apply SSE-S3 encryption automatically.. AWS Config can continuously evaluate S3 buckets against a custom rule that checks for SSE-S3 encryption. When a non-compliant bucket is detected, AWS Systems Manager Automation can automatically remediate it by applying the required encryption, meeting the requirement for automatic remediation without manual intervention.

Answer

Create an SCP that denies s3:PutBucketEncryption with a condition that the encryption is not SSE-S3.

Answer

Create a CloudFormation template that includes a bucket with SSE-S3 enabled and deploy it via StackSets to all accounts.

Answer

Enable S3 Block Public Access at the organization level.

Question 14

A developer is building a serverless application that processes personally identifiable information (PII). The application uses API Gateway, Lambda, and DynamoDB. The developer needs to ensure that the PII is encrypted at rest in DynamoDB. The company already uses AWS KMS with a customer-managed key for other services. The developer wants to reuse the same KMS key for DynamoDB. After enabling encryption with the KMS key, the Lambda function fails to write to the table with an AccessDenied error. The Lambda execution role has dynamodb:PutItem permission. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks kms:Encrypt and kms:Decrypt permissions on the customer-managed KMS key.. When a DynamoDB table is encrypted with a customer-managed KMS key, any operation that reads or writes data to the table requires the caller to have permissions to use that KMS key. Even though the Lambda execution role has dynamodb:PutItem permission, the PutItem operation internally triggers KMS Encrypt and Decrypt calls to manage the encryption of the item. Without kms:Encrypt and kms:Decrypt permissions on the specific KMS key, the request fails with an AccessDenied error.

Answer

The Lambda execution role does not have DynamoDB write permissions.

Answer

The DynamoDB table has a resource-based policy that denies access.

Answer

The Lambda function is not in a VPC, so it cannot access the KMS key.

Question 15

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application needs to authenticate users using a third-party identity provider that supports SAML 2.0. The company wants to use AWS Identity and Access Management (IAM) to manage user permissions. Which solution should the developer implement?

Accepted Answer

Create an IAM identity provider for the SAML IdP and set up a role with a trust policy that allows federated users to assume it.. It describes the standard AWS pattern for SAML 2.0 federation: creating an IAM identity provider for the external SAML IdP, then configuring an IAM role with a trust policy that allows users authenticated by that IdP to assume the role. This enables the application to use IAM to manage permissions for federated users without creating IAM users in the AWS account.

Answer

Use AWS Security Token Service (STS) to generate temporary credentials for the users.

Answer

Store the SAML metadata document in AWS Certificate Manager.

Answer

Use Amazon Cognito user pools with a SAML identity provider.