DVA-C02 Security Practice Test 28 — 15 Questions

Question 1

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted using SSE-KMS with a specific KMS key from the central security account. They also want to prevent any unencrypted bucket creation. A developer in the development account creates a new S3 bucket and enables default encryption using SSE-S3. The bucket creation succeeds, but the security team wants to prevent this. The developer argues that the bucket still encrypts data at rest. Compliance requires SSE-KMS only. What should the security team do to enforce this policy across all accounts?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Create a service control policy (SCP) that denies s3:PutObject and s3:PutBucketEncryption unless the encryption is SSE-KMS with the specific KMS key.. A service control policy (SCP) applied at the AWS Organizations root or OU level can centrally deny S3 bucket creation and encryption configuration unless SSE-KMS with the specific KMS key is used. SCPs affect all accounts in the organization, preventing developers from bypassing the policy by creating buckets with SSE-S3, as the SCP condition key `s3:x-amz-server-side-encryption` and `s3:x-amz-server-side-encryption-aws-kms-key-id` enforce the required encryption at the API level before the bucket is created.

Answer

Create an IAM policy in the central security account that denies s3:PutBucketEncryption if the encryption is not SSE-KMS.

Answer

Use AWS Config to detect non-compliant buckets and automatically apply default encryption with SSE-KMS.

Answer

Enable CloudTrail to log all S3 API calls and manually review for non-compliant buckets.

Question 2

A company has a centralized logging solution where all EC2 instances send logs to a CloudWatch Logs group in a central account. The EC2 instances are in a different account (App Account). The developer configures the CloudWatch agent on the instances with the necessary IAM role. However, logs are not appearing in the central account's log group. The IAM role in the App Account has permissions to put logs to the central account's log group. What is the most likely missing configuration?

Accepted Answer

The central account's log group must have a resource-based policy that grants the App Account's IAM role permissions to put logs.. For cross-account CloudWatch Logs, the central account's log group must have a resource-based policy that grants the App Account's IAM role permission to put logs. Even if the IAM role in the App Account has permissions, the destination log group must also allow the source. This is a common missing configuration.

Answer

CloudWatch Logs must be encrypted with the same KMS key in both accounts.

Answer

The log group must be in the same region as the EC2 instances.

Answer

The EC2 instances must be in a VPC with a VPC endpoint for CloudWatch Logs.

Question 3

A company uses an S3 bucket to store sensitive customer data. The bucket policy currently allows access to a specific IAM role used by an EC2 instance. A security audit reveals that the bucket is also accessible from an external AWS account. Which action should the security team take to restrict access to only the intended role?

Accepted Answer

Add a condition in the bucket policy to allow access only when the request includes the specific IAM role ARN.. Adding a condition in the bucket policy using the `aws:PrincipalArn` condition key allows you to restrict access exclusively to the specific IAM role ARN. This ensures that even if the bucket policy grants access to an external AWS account, only requests made by the designated IAM role (e.g., `arn:aws:iam::123456789012:role/EC2AppRole`) will be allowed, effectively blocking any other principals, including those from external accounts.

Answer

Use S3 Object Ownership to disable ACLs.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Modify the IAM role trust policy to only allow the EC2 instance.

Question 4

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The instance has an IAM role with a policy that allows s3:GetObject on the bucket. However, the application receives an AccessDenied error. The bucket policy is as follows:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::123456789012:role/AppRole"
      },
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

The EC2 instance is using the correct IAM role. What is the most likely cause of the error?

Accepted Answer

The IAM role attached to the EC2 instance has a different ARN than the one specified in the bucket policy.. The correct answer is B: the IAM role attached to the EC2 instance has a different ARN than the one specified in the bucket policy. In S3, when a bucket policy explicitly names a Principal, the request must come from exactly that principal; if the instance's role ARN differs (for example, a different role name, path, or account), the bucket policy does not grant access and the request is denied even though the identity-based policy allows s3:GetObject. Option A is wrong because SSE-S3 encryption is transparent to clients and does not cause AccessDenied. Option C is wrong because it merely restates that both policies allow the action, which would not produce a denial. Option D is wrong because the shown bucket policy contains no MFA condition.

Answer

The bucket uses default encryption with SSE-S3, and the application does not support it.

Answer

The IAM role policy allows s3:GetObject, but the bucket policy also must allow it, which it does.

Answer

The bucket policy requires MFA, but the application does not provide it.

Question 5

A developer needs to securely store database credentials for a Lambda function. The credentials should be automatically rotated every 30 days. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports native rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in Lambda rotation functions, and can be configured to rotate on a schedule (e.g., every 30 days) without custom code. The service also integrates directly with Lambda via the AWS SDK to retrieve secrets at runtime, ensuring credentials are never hardcoded.

Answer

AWS Key Management Service (KMS) to encrypt the credentials.

Answer

Store the credentials in an IAM role's trust policy.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Question 6

A company uses an AWS Lambda function to process files uploaded to an S3 bucket. The Lambda function needs to read the files and write results to a DynamoDB table. The Lambda function is configured with an IAM role that has policies allowing s3:GetObject on the bucket and dynamodb:PutItem on the table. Despite correct permissions, the function fails with an AccessDenied error when trying to put items. What is the most likely cause?

Accepted Answer

The DynamoDB table has a resource-based policy that explicitly denies access to the Lambda function's IAM role.. DynamoDB tables can have resource-based policies that explicitly deny access even if the IAM role has the necessary permissions. Since explicit denies in resource-based policies override any allow in identity-based policies, the Lambda function's IAM role with dynamodb:PutItem permission is still blocked, causing the AccessDenied error.

Answer

The Lambda function is in a VPC without a VPC endpoint for DynamoDB.

Answer

The S3 bucket is in a different region, causing cross-region access issues.

Answer

The DynamoDB table is encrypted with a customer managed KMS key, and the Lambda role does not have kms:Decrypt permission.

Question 7

A developer is designing a serverless application using API Gateway, Lambda, and DynamoDB. The API must authenticate users using a JWT token. Which API Gateway feature should the developer use to validate the JWT before invoking the Lambda function?

Accepted Answer

Use a Lambda authorizer (custom authorizer).. A Lambda authorizer (custom authorizer) is required to validate JWTs issued by a third-party identity provider (IdP) in API Gateway REST APIs. While Amazon Cognito user pool authorizers can natively validate Cognito-issued JWTs, they cannot validate tokens from external providers. A Lambda authorizer allows you to run custom code to verify the signature, expiration, and claims of any third-party JWT before routing the request to the backend Lambda function.

Answer

Use an IAM authorizer with a resource policy.

Answer

Use an Amazon Cognito user pool authorizer.

Answer

Use an API Gateway resource policy to allow only authenticated IPs.

Question 8

A company is using AWS KMS to encrypt data in S3. Which TWO actions are required to allow an IAM user to decrypt objects in a specific S3 bucket?

Accepted Answer

Attach a policy to the user allowing s3:GetObject on the bucket.. To decrypt an object stored in S3 using server-side encryption with AWS KMS (SSE-KMS), the IAM user must have the s3:GetObject permission to retrieve the encrypted object from the bucket. Without this permission, the user cannot even initiate the GetObject request, regardless of KMS permissions.

Answer

Attach a policy to the user allowing kms:Encrypt.

Answer

Attach a policy to the user allowing s3:PutObject.

Answer

Attach a policy to the user allowing kms:GenerateDataKey.

Question 9

A company wants to securely store database credentials for a Lambda function. The credentials must be automatically rotated. Which TWO services should be used together?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials and other secrets. It integrates natively with AWS Lambda and supports automatic rotation via a built-in rotation function or a custom Lambda function, meeting the requirement for automated credential rotation without manual intervention.

Answer

AWS KMS

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 10

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AES-256 using SSE-S3. They also want to automatically remediate any bucket that is created without encryption. The team currently uses AWS CloudFormation StackSets to deploy resources. They need a solution that does not require manual intervention. Which approach should be taken?

Accepted Answer

Configure an AWS Config rule to detect buckets without SSE-S3 and use AWS Systems Manager Automation to apply SSE-S3 encryption automatically.. AWS Config can continuously evaluate S3 buckets against a custom rule that checks for SSE-S3 encryption. When a non-compliant bucket is detected, AWS Systems Manager Automation can automatically remediate it by applying the required encryption, meeting the requirement for automatic remediation without manual intervention.

Answer

Create an SCP that denies s3:PutBucketEncryption with a condition that the encryption is not SSE-S3.

Answer

Create a CloudFormation template that includes a bucket with SSE-S3 enabled and deploy it via StackSets to all accounts.

Answer

Enable S3 Block Public Access at the organization level.

Question 11

A developer is building a serverless application that processes personally identifiable information (PII). The application uses API Gateway, Lambda, and DynamoDB. The developer needs to ensure that the PII is encrypted at rest in DynamoDB. The company already uses AWS KMS with a customer-managed key for other services. The developer wants to reuse the same KMS key for DynamoDB. After enabling encryption with the KMS key, the Lambda function fails to write to the table with an AccessDenied error. The Lambda execution role has dynamodb:PutItem permission. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks kms:Encrypt and kms:Decrypt permissions on the customer-managed KMS key.. When a DynamoDB table is encrypted with a customer-managed KMS key, any operation that reads or writes data to the table requires the caller to have permissions to use that KMS key. Even though the Lambda execution role has dynamodb:PutItem permission, the PutItem operation internally triggers KMS Encrypt and Decrypt calls to manage the encryption of the item. Without kms:Encrypt and kms:Decrypt permissions on the specific KMS key, the request fails with an AccessDenied error.

Answer

The Lambda execution role does not have DynamoDB write permissions.

Answer

The DynamoDB table has a resource-based policy that denies access.

Answer

The Lambda function is not in a VPC, so it cannot access the KMS key.

Question 12

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application needs to authenticate users using a third-party identity provider that supports SAML 2.0. The company wants to use AWS Identity and Access Management (IAM) to manage user permissions. Which solution should the developer implement?

Accepted Answer

Create an IAM identity provider for the SAML IdP and set up a role with a trust policy that allows federated users to assume it.. It describes the standard AWS pattern for SAML 2.0 federation: creating an IAM identity provider for the external SAML IdP, then configuring an IAM role with a trust policy that allows users authenticated by that IdP to assume the role. This enables the application to use IAM to manage permissions for federated users without creating IAM users in the AWS account.

Answer

Use AWS Security Token Service (STS) to generate temporary credentials for the users.

Answer

Store the SAML metadata document in AWS Certificate Manager.

Answer

Use Amazon Cognito user pools with a SAML identity provider.

Question 13

A developer is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy to EC2 instances. The application stores sensitive data in an S3 bucket. The developer needs to ensure that the S3 bucket is only accessible from the EC2 instances and not from any other AWS service or account. The EC2 instances have an IAM role that allows s3:GetObject. What additional configuration is required?

Accepted Answer

Add a bucket policy that allows access only from the VPC endpoint or specific IP addresses of the EC2 instances.. A bucket policy that restricts access to the S3 bucket from a specific VPC endpoint or the EC2 instances' IP addresses ensures that only requests originating from those sources are allowed. This complements the IAM role's s3:GetObject permission by adding a network-level condition, preventing other AWS services or accounts from accessing the bucket even if they have valid IAM credentials. The condition key `aws:SourceVpce` or `aws:SourceIp` in the bucket policy enforces this restriction.

Answer

Use SSE-KMS encryption on the bucket.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Move the sensitive data to a different S3 bucket and update the application.

Question 14

A company has a legacy application running on an EC2 instance that stores database credentials in a plain text configuration file. The security team requires that credentials be stored securely and rotated every 90 days. The developer must minimize changes to the application code. The application currently reads the configuration file from the file system. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to store the credentials and configure automatic rotation with a Lambda function. Modify the application to retrieve the secret from Secrets Manager.. AWS Secrets Manager provides built-in support for automatic credential rotation using a Lambda function, meeting the 90-day rotation requirement without manual intervention. By modifying the application to retrieve the secret via the Secrets Manager API, the credentials are no longer stored in plain text, satisfying the security team's mandate. This approach minimizes code changes because the application only needs to replace the file read with an API call, preserving the existing logic structure.

Answer

Encrypt the configuration file using AWS KMS and store the encrypted file on S3.

Answer

Store the credentials in environment variables on the EC2 instance.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString and retrieve them at application startup.

Question 15

A company is using an S3 bucket to store sensitive documents. They need to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. The bucket policy must enforce encryption by denying uploads that do not specify the required encryption. Which bucket policy statement should be added?

Accepted Answer

Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'aws:kms'. The bucket policy uses the `s3:x-amz-server-side-encryption` condition key with `StringNotEquals` to deny any upload where the header does not specify `aws:kms`. This ensures that only objects encrypted with AWS KMS (SSE-KMS) are allowed, enforcing server-side encryption at rest. The `Deny` effect combined with this condition blocks requests that either omit the encryption header or specify a different value like `AES256`.

Answer

Condition: StringEquals: 's3:x-amz-server-side-encryption-aws:kms': 'true'

Answer

Condition: Null: 's3:x-amz-server-side-encryption': 'true'

Answer

Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'AES256'