DVA-C02 Security Practice Test 3 — 15 Questions

Question 1

Refer to the exhibit. A developer is trying to query a DynamoDB table from a Lambda function that uses an execution role named MyRole. The Lambda function is failing with the error shown. Which step should the developer take to resolve this?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Attach a policy to the Lambda execution role that allows dynamodb:Query on the table.. The error indicates that the Lambda execution role MyRole lacks the dynamodb:Query permission on the DynamoDB table. Option C is correct: attach a policy to the Lambda execution role that allows dynamodb:Query on the table. Option A is incorrect because the error is about permissions, not encryption. Option B is incorrect because resource-based policies are used to grant cross-account access, not to grant permissions to a role within the same account. Option D is incorrect because the error is not related to KMS keys.

Answer

Enable DynamoDB encryption at rest.

Answer

Add a resource-based policy to the DynamoDB table allowing the Lambda role.

Answer

Grant the Lambda role kms:Decrypt permission on the KMS key.

Question 2

A company uses AWS KMS to encrypt data at rest in S3. The security team wants to audit all use of the KMS key, including decryption operations. What should the developer enable?

Accepted Answer

Enable AWS CloudTrail with data events for the KMS key.. AWS CloudTrail logs all KMS API calls, including Decrypt, Encrypt, and GenerateDataKey. This provides the audit trail required. Option A is wrong because S3 server access logs do not include KMS operation details. Option C is wrong because CloudWatch Logs is for log storage, not for capturing API calls. Option D is wrong because AWS Config records resource configuration changes, not API calls.

Answer

Enable AWS Config rules to monitor key usage.

Answer

Enable S3 server access logging.

Answer

Create a CloudWatch Logs log group and stream KMS logs.

Question 3

A developer is building a serverless application with AWS Lambda that needs to read from an Amazon DynamoDB table. The Lambda function is in a VPC. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Attach an IAM role to the Lambda function that allows the necessary DynamoDB actions.. Attaching an IAM role to the Lambda function is the most secure way because it provides temporary credentials automatically rotated by AWS, eliminating the need to manage static credentials. The role grants least privilege access to DynamoDB.

Answer

Create a VPC endpoint for DynamoDB and associate a security group.

Answer

Store DynamoDB credentials in AWS Secrets Manager and retrieve them in the Lambda code.

Answer

Use an EC2 instance profile attached to the Lambda function's execution environment.

Question 4

A developer needs to allow an IAM user to temporarily access an AWS account for 12 hours. The developer must not create long-term credentials. What should the developer use?

Accepted Answer

Use AWS STS to generate temporary security credentials for a role.. AWS STS AssumeRole returns temporary credentials (access key, secret key, session token) with a configurable duration up to the role's maximum session duration (up to 12 hours for roles, or 1 hour default). This satisfies the requirement of 12-hour temporary access without creating long-term IAM user credentials. The developer creates a role with the needed permissions and the user assumes it via STS.

Answer

Create an IAM user with a password and access keys.

Answer

Attach a resource-based policy to the account.

Answer

Use Amazon Cognito user pools to generate temporary access.

Question 5

A developer is implementing a solution to encrypt data in transit for a web application running on an Application Load Balancer (ALB). Which TWO actions should the developer take?

Accepted Answer

Configure the ALB listener to use HTTPS protocol.. To encrypt data in transit between clients and the ALB, you need to configure the ALB listener to use HTTPS (B) and install an SSL/TLS certificate on the ALB (E). Option A (client-side encryption) encrypts data within the application, not at the ALB level. Option C (S3 server-side encryption) protects data at rest, not in transit. Option D (security group rule) restricts traffic but does not provide encryption.

Answer

Use client-side encryption in the application code.

Answer

Enable S3 server-side encryption for application logs.

Answer

Add a security group rule to allow only HTTPS traffic.

Question 6

A developer is designing a CI/CD pipeline using AWS CodePipeline. The pipeline must deploy to multiple AWS accounts. Which THREE components are required to securely deploy across accounts?

Accepted Answer

The pipeline's service role must have a trust policy allowing it to assume the target account role.. For cross-account deployments in CodePipeline, you need: A) the pipeline's service role must be allowed to assume the target account role, B) an IAM role in the target account with deploy permissions, and E) a customer-managed KMS key to encrypt artifacts. The artifact bucket is required but it resides in the pipeline account, not the target account, so option D as phrased is incorrect. A customer-managed KMS key is mandatory for cross-account artifact encryption; you cannot use the default S3-managed key for cross-account access.

Answer

A CodeCommit repository in each account.

Answer

An S3 artifact bucket that the pipeline can access in the target account.

Question 7

The exhibit shows an S3 bucket policy. If an IAM user in the same AWS account attempts to download an object from the bucket from IP address 203.0.113.5, what will happen?

Accepted Answer

The request will be denied.. The bucket policy allows GetObject only if the source IP is within 192.0.2.0/24. Since the IAM user's IP address (203.0.113.5) is outside that range, the Allow statement does not apply. With no applicable Allow, the default implicit deny takes effect, and the request is denied. IAM permissions cannot override a bucket policy's conditions; they only grant access if the policy also allows it. Therefore, the correct answer is D: the request will be denied.

Answer

The request will succeed because the user has IAM permissions.

Answer

The request will succeed because the user is in the same account.

Answer

The request will succeed because the bucket policy does not explicitly deny.

Question 8

A developer ran the AWS CLI command shown in the exhibit. What is the most likely cause of the error?

Accepted Answer

The AWS Region does not support CloudHSM custom key stores.. The error is most likely because the AWS Region does not support CloudHSM custom key stores. AWS KMS custom key stores backed by CloudHSM are only available in specific Regions where CloudHSM clusters can be created. If the CLI command was run in a Region without CloudHSM support, the create-custom-key-store operation would fail with an error indicating the Region is not supported.

Answer

The --origin parameter is misspelled.

Answer

The --key-spec parameter is invalid for custom key stores.

Answer

The IAM user does not have permission to create KMS keys.

Question 9

A company wants to allow cross-account access to a DynamoDB table. They set up an IAM role in Account A (table owner) and allow Account B's users to assume the role. Which additional step is required?

Accepted Answer

Configure the trust policy of the IAM role in Account A to allow Account B to assume it. To allow cross-account access to a DynamoDB table, the IAM role in Account A (the table owner) must have a trust policy that explicitly grants permission to Account B's users or account to assume the role. This is the additional step beyond creating the role. Option A is incorrect because DynamoDB does not support resource-based policies on tables; access is controlled via IAM policies. Option B is incorrect because bucket policies are for S3, not DynamoDB. Option C is incorrect because while the IAM role does need a permissions policy allowing DynamoDB actions, the question asks for the additional step required; the permissions policy is typically part of creating the role, but the trust policy is the critical additional configuration for cross-account access.

Answer

Add a policy to the DynamoDB table allowing Account B

Answer

Create a bucket policy in Account A

Answer

Attach a policy to the IAM role that allows DynamoDB actions

Question 10

A developer set up a Lambda function that reads from an SQS queue and processes messages. The function sometimes times out. How can the developer improve security while minimizing execution time?

Accepted Answer

Reduce the SQS visibility timeout to match the Lambda function's timeout. Reducing the SQS visibility timeout to match the Lambda function's timeout minimizes execution time by preventing duplicate processing: if the first invocation times out, the message becomes visible again only after the function has definitely stopped, avoiding wasted reprocessing. This also improves security by ensuring messages are not partially processed multiple times, which could lead to unintended operations or data exposure. Option A (encryption at rest) protects data but doesn’t affect execution time. Option B (DLQ) handles failures but doesn’t reduce execution time. Option C (increasing Lambda timeout) may extend processing time and doesn’t inherently improve security.

Answer

Use encryption at rest for the SQS queue

Answer

Enable a dead-letter queue (DLQ) for the SQS queue

Answer

Increase the Lambda function timeout to 15 minutes

Question 11

An application uses a custom KMS key to encrypt data. The application runs on an EC2 instance. To decrypt data, the application must call KMS. What is the BEST practice to securely provide the KMS key ID to the application?

Accepted Answer

Use an environment variable to pass the key ID to the application. The KMS key ID is not a secret — it's an identifier, not the key material itself. The actual cryptographic operations are authorized via IAM, so the application needs the key ID plus permission to call kms:Decrypt. Passing the key ID as an environment variable is the AWS-recommended best practice for externalizing configuration from code, allowing the same artifact to run across environments (dev/staging/prod) with different key IDs injected at runtime. This aligns with the 12-factor app methodology and avoids redeployment when the key rotates or changes.

Answer

Hardcode the key ID in the application code

Answer

Store the key ID in a configuration file on the instance

Answer

Retrieve the key ID using the instance's IAM role

Question 12

A company uses AWS KMS with imported key material. The key material is expired. What must the developer do to continue using the KMS key?

Accepted Answer

Delete the existing key and create a new one with new key material. The correct answer is D: delete the existing key and create a new one with new key material. When you import key material into an AWS KMS key, that key material has an expiration time, and once it expires the KMS key can no longer be used for cryptographic operations; imported key material cannot be renewed or extended, so the only way to continue is to create a new KMS key and import fresh key material. Option A is wrong because an expired key cannot be used, option B is wrong because re-importing the same expired material into a new key does not make it valid, and option C is wrong because automatic key rotation does not apply to KMS keys with imported key material.

Answer

Use the existing key until it expires

Answer

Create a new KMS key and re-import the same key material

Answer

Enable automatic key rotation

Question 13

A developer attached the above IAM policy to an IAM user. The user is trying to get an object from the bucket 'example-bucket' from an on-premises machine with public IP 203.0.113.5. What will happen?

Accepted Answer

Access is denied because the condition is not met. The IAM policy includes a condition that restricts the s3:GetObject action to requests originating from IP address 10.0.0.1/32. Since the user's request comes from public IP 203.0.113.5, the condition is not met. Therefore, despite the Allow effect, the request is denied because the condition fails. Option B correctly states that access is denied because the condition is not met.

Answer

Access is allowed because the user has an Allow effect

Answer

Access is allowed if the user uses a VPN with the specified IP

Answer

Access is allowed because the user's IP is not denied

Question 14

A company wants to securely store database credentials for a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets such as database credentials, with native integration to Lambda via the AWS SDK and automatic rotation using Lambda rotation functions. It encrypts secrets with KMS and supports fine-grained IAM access, making it the correct choice for securely storing database credentials for a Lambda function.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store (Standard tier)

Answer

Amazon S3 with server-side encryption

Question 15

A developer needs to grant an IAM user access to an S3 bucket owned by another AWS account. Which method should be used?

Accepted Answer

Attach a bucket policy to the bucket that allows the user's IAM user ARN.. A cross-account S3 access pattern is best solved with a bucket policy on the bucket owner's side that explicitly grants the external IAM user's ARN the required S3 actions. The bucket policy is evaluated by S3 and allows the external principal to access the bucket without creating new identities or roles. This is the standard, least-privilege method for granting cross-account access to a specific user.

Answer

Create an IAM role in the bucket owner account and allow the user to assume it.

Answer

Create a new IAM user in the bucket owner account for the developer.

Answer

Add the user to a bucket ACL granting access.