DVA-C02 Security Practice Test 28 — 15 Questions

Question 1

A company uses an AWS Lambda function to process files uploaded to an S3 bucket. The Lambda function needs to read the files and write results to a DynamoDB table. The Lambda function is configured with an IAM role that has policies allowing s3:GetObject on the bucket and dynamodb:PutItem on the table. Despite correct permissions, the function fails with an AccessDenied error when trying to put items. What is the most likely cause?

Accepted Answer

The DynamoDB table has a resource-based policy that explicitly denies access to the Lambda function's IAM role.. The correct answer is B because DynamoDB tables can have resource-based policies that explicitly deny access even if the IAM role has the necessary permissions. Since explicit denies in resource-based policies override any allow in identity-based policies, the Lambda function's IAM role with dynamodb:PutItem permission is still blocked, causing the AccessDenied error.

Answer

The Lambda function is in a VPC without a VPC endpoint for DynamoDB.

Answer

The S3 bucket is in a different region, causing cross-region access issues.

Answer

The DynamoDB table is encrypted with a customer managed KMS key, and the Lambda role does not have kms:Decrypt permission.

Question 2

A developer is designing a serverless application using API Gateway, Lambda, and DynamoDB. The API must authenticate users using a JWT token. Which API Gateway feature should the developer use to validate the JWT before invoking the Lambda function?

Accepted Answer

Use a Lambda authorizer (custom authorizer).. Option C is correct because a Lambda authorizer (custom authorizer) allows the developer to implement custom JWT validation logic, such as verifying the token's signature, expiry, and claims, before the request reaches the Lambda function. This is the most flexible approach when the JWT is issued by a third-party identity provider (IdP) that is not Amazon Cognito, as API Gateway's native JWT authorizer only supports JWTs from specific providers like Cognito or Auth0. The Lambda authorizer can return an IAM policy to allow or deny the request, enabling fine-grained access control based on the token's content.

Answer

Use an IAM authorizer with a resource policy.

Answer

Use an Amazon Cognito user pool authorizer.

Answer

Use an API Gateway resource policy to allow only authenticated IPs.

Question 3

A company wants to encrypt data at rest in an S3 bucket. Which AWS service can provide encryption keys that are managed by AWS and rotated automatically?

Accepted Answer

SSE-S3 (Server-Side Encryption with S3 Managed Keys). SSE-S3 uses encryption keys that are managed entirely by AWS and are rotated automatically on a regular basis. This option meets the requirement for AWS-managed keys with automatic rotation without any additional configuration or cost.

Answer

SSE-KMS (Server-Side Encryption with AWS KMS)

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys)

Answer

Client-side encryption using AWS KMS.

Question 4

A developer is deploying an application on EC2 instances behind an Application Load Balancer. The application must support mutual TLS (mTLS) authentication between clients and the load balancer. Which configuration is required?

Accepted Answer

Create a trust store in AWS Certificate Manager Private CA and associate it with the ALB.. Option C is correct because mutual TLS (mTLS) on an Application Load Balancer requires a trust store that contains the trusted Certificate Authority (CA) certificates used to validate client certificates. This trust store must be created in AWS Certificate Manager Private CA and then associated with the ALB's listener rules. The ALB then performs client certificate verification during the TLS handshake, ensuring both the server and client present valid certificates.

Answer

Use a Network Load Balancer (NLB) with TLS listeners.

Answer

Configure listener rules on the ALB to require client certificates.

Answer

Use Amazon CloudFront with a custom origin and require client certificates.

Question 5

A company is using AWS KMS to encrypt data in S3. Which TWO actions are required to allow an IAM user to decrypt objects in a specific S3 bucket?

Accepted Answer

Attach a policy to the user allowing s3:GetObject on the bucket.. Option A is correct because to decrypt an object stored in S3 using server-side encryption with AWS KMS (SSE-KMS), the IAM user must have the s3:GetObject permission to retrieve the encrypted object from the bucket. Without this permission, the user cannot even initiate the GetObject request, regardless of KMS permissions.

Answer

Attach a policy to the user allowing kms:Encrypt.

Answer

Attach a policy to the user allowing s3:PutObject.

Answer

Attach a policy to the user allowing kms:GenerateDataKey.

Question 6

A developer is configuring an S3 bucket to host a static website. The bucket must be accessible to anyone on the internet, but only for reading objects. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Enable static website hosting on the bucket.. Option C is correct because enabling static website hosting on the S3 bucket is a prerequisite for serving content as a website. Without this setting, the bucket cannot serve HTTP requests for web pages, even if objects are publicly readable. This configuration provides an endpoint URL and allows index and error document routing.

Answer

Set the bucket ACL to public-read.

Answer

Create an Amazon CloudFront distribution with the bucket as origin.

Question 7

A company wants to securely store database credentials for a Lambda function. The credentials must be automatically rotated. Which TWO services should be used together?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials and other secrets. It integrates natively with AWS Lambda and supports automatic rotation via a built-in rotation function or a custom Lambda function, meeting the requirement for automated credential rotation without manual intervention.

Answer

AWS KMS

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store

Question 8

A company has a multi-account AWS environment using AWS Organizations. The security team wants to enforce that all S3 buckets across all accounts are encrypted with AES-256 using SSE-S3. They also want to automatically remediate any bucket that is created without encryption. The team currently uses AWS CloudFormation StackSets to deploy resources. They need a solution that does not require manual intervention. Which approach should be taken?

Accepted Answer

Configure an AWS Config rule to detect buckets without SSE-S3 and use AWS Systems Manager Automation to apply SSE-S3 encryption automatically.. Option B is correct because AWS Config can continuously evaluate S3 buckets against a custom rule that checks for SSE-S3 encryption. When a non-compliant bucket is detected, AWS Systems Manager Automation can automatically remediate it by applying the required encryption, meeting the requirement for automatic remediation without manual intervention.

Answer

Create an SCP that denies s3:PutBucketEncryption with a condition that the encryption is not SSE-S3.

Answer

Create a CloudFormation template that includes a bucket with SSE-S3 enabled and deploy it via StackSets to all accounts.

Answer

Enable S3 Block Public Access at the organization level.

Question 9

A developer is building a serverless application that processes personally identifiable information (PII). The application uses API Gateway, Lambda, and DynamoDB. The developer needs to ensure that the PII is encrypted at rest in DynamoDB. The company already uses AWS KMS with a customer-managed key for other services. The developer wants to reuse the same KMS key for DynamoDB. After enabling encryption with the KMS key, the Lambda function fails to write to the table with an AccessDenied error. The Lambda execution role has dynamodb:PutItem permission. What is the most likely cause?

Accepted Answer

The Lambda execution role lacks kms:Encrypt and kms:Decrypt permissions on the customer-managed KMS key.. When a DynamoDB table is encrypted with a customer-managed KMS key, any operation that reads or writes data to the table requires the caller to have permissions to use that KMS key. Even though the Lambda execution role has dynamodb:PutItem permission, the PutItem operation internally triggers KMS Encrypt and Decrypt calls to manage the encryption of the item. Without kms:Encrypt and kms:Decrypt permissions on the specific KMS key, the request fails with an AccessDenied error.

Answer

The Lambda execution role does not have DynamoDB write permissions.

Answer

The DynamoDB table has a resource-based policy that denies access.

Answer

The Lambda function is not in a VPC, so it cannot access the KMS key.

Question 10

A company is deploying a web application on EC2 instances behind an Application Load Balancer. The application needs to authenticate users using a third-party identity provider that supports SAML 2.0. The company wants to use AWS Identity and Access Management (IAM) to manage user permissions. Which solution should the developer implement?

Accepted Answer

Create an IAM identity provider for the SAML IdP and set up a role with a trust policy that allows federated users to assume it.. Option B is correct because it describes the standard AWS pattern for SAML 2.0 federation: creating an IAM identity provider for the external SAML IdP, then configuring an IAM role with a trust policy that allows users authenticated by that IdP to assume the role. This enables the application to use IAM to manage permissions for federated users without creating IAM users in the AWS account.

Answer

Use AWS Security Token Service (STS) to generate temporary credentials for the users.

Answer

Store the SAML metadata document in AWS Certificate Manager.

Answer

Use Amazon Cognito user pools with a SAML identity provider.

Question 11

A developer is using AWS CodePipeline to deploy a web application. The pipeline includes a source stage from CodeCommit, a build stage using CodeBuild, and a deploy stage using CodeDeploy to EC2 instances. The application stores sensitive data in an S3 bucket. The developer needs to ensure that the S3 bucket is only accessible from the EC2 instances and not from any other AWS service or account. The EC2 instances have an IAM role that allows s3:GetObject. What additional configuration is required?

Accepted Answer

Add a bucket policy that allows access only from the VPC endpoint or specific IP addresses of the EC2 instances.. Option C is correct because a bucket policy that restricts access to the S3 bucket from a specific VPC endpoint or the EC2 instances' IP addresses ensures that only requests originating from those sources are allowed. This complements the IAM role's s3:GetObject permission by adding a network-level condition, preventing other AWS services or accounts from accessing the bucket even if they have valid IAM credentials. The condition key `aws:SourceVpce` or `aws:SourceIp` in the bucket policy enforces this restriction.

Answer

Use SSE-KMS encryption on the bucket.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Move the sensitive data to a different S3 bucket and update the application.

Question 12

A company has a legacy application running on an EC2 instance that stores database credentials in a plain text configuration file. The security team requires that credentials be stored securely and rotated every 90 days. The developer must minimize changes to the application code. The application currently reads the configuration file from the file system. Which solution meets these requirements?

Accepted Answer

Use AWS Secrets Manager to store the credentials and configure automatic rotation with a Lambda function. Modify the application to retrieve the secret from Secrets Manager.. Option B is correct because AWS Secrets Manager provides built-in support for automatic credential rotation using a Lambda function, meeting the 90-day rotation requirement without manual intervention. By modifying the application to retrieve the secret via the Secrets Manager API, the credentials are no longer stored in plain text, satisfying the security team's mandate. This approach minimizes code changes because the application only needs to replace the file read with an API call, preserving the existing logic structure.

Answer

Encrypt the configuration file using AWS KMS and store the encrypted file on S3.

Answer

Store the credentials in environment variables on the EC2 instance.

Answer

Store the credentials in AWS Systems Manager Parameter Store as a SecureString and retrieve them at application startup.

Question 13

A company is using an S3 bucket to store sensitive documents. They need to ensure that all objects are encrypted at rest using server-side encryption with AWS KMS. The bucket policy must enforce encryption by denying uploads that do not specify the required encryption. Which bucket policy statement should be added?

Accepted Answer

Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'aws:kms'. Option A is correct because the bucket policy uses the `s3:x-amz-server-side-encryption` condition key with `StringNotEquals` to deny any upload where the header does not specify `aws:kms`. This ensures that only objects encrypted with AWS KMS (SSE-KMS) are allowed, enforcing server-side encryption at rest. The `Deny` effect combined with this condition blocks requests that either omit the encryption header or specify a different value like `AES256`.

Answer

Condition: StringEquals: 's3:x-amz-server-side-encryption-aws:kms': 'true'

Answer

Condition: Null: 's3:x-amz-server-side-encryption': 'true'

Answer

Condition: StringNotEquals: 's3:x-amz-server-side-encryption': 'AES256'

Question 14

A developer is troubleshooting an IAM policy that is supposed to allow a Lambda function to read objects from an S3 bucket. The Lambda function role has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":["s3:GetObject","s3:ListBucket"],"Resource":["arn:aws:s3:::example-bucket/*","arn:aws:s3:::example-bucket"]}]}. Despite this, the Lambda function receives an AccessDenied error when trying to read objects. What is the most likely cause?

Accepted Answer

The S3 bucket has a bucket policy that explicitly denies the Lambda function's access.. The IAM policy attached to the Lambda function role correctly grants s3:GetObject and s3:ListBucket permissions on the bucket and its objects. However, if the S3 bucket itself has a bucket policy that explicitly denies access to the Lambda function's role, that explicit deny overrides any allow from IAM policies, resulting in an AccessDenied error. This is because AWS evaluates all policies (identity-based and resource-based) and an explicit deny always takes precedence.

Answer

The IAM policy does not include the s3:GetObjectVersion action.

Answer

The Lambda function is in a different AWS account than the S3 bucket.

Answer

The IAM policy uses an incorrect resource ARN format.

Question 15

An application running on EC2 instances needs to access an S3 bucket securely. Which of the following is the BEST practice for managing credentials?

Accepted Answer

Launch the EC2 instance with an IAM role that grants S3 access.. Option C is correct because assigning an IAM role to an EC2 instance is the AWS-recommended best practice for securely granting permissions to AWS services. The instance automatically obtains temporary security credentials from the instance metadata service (IMDS), eliminating the need to hardcode or manage long-term access keys. This approach follows the principle of least privilege and avoids the security risks of storing credentials on disk.

Answer

Store the AWS access key and secret key in a configuration file on the EC2 instance.

Answer

Use an IAM user with programmatic access and attach a policy allowing S3 access.

Answer

Use a shared secret key stored in AWS Secrets Manager and retrieve it at runtime.