DVA-C02 Security Practice Test 3 — 15 Questions

Question 1

A developer runs the commands above. The key is disabled. An application that uses this key to encrypt S3 objects starts failing. What should the developer do to fix the issue?

Accepted Answer

Enable the KMS key. Enable the KMS key. The key is disabled, so enabling it will restore functionality. Option A (delete the key and recreate it) would create a new key, but the application would need to be updated to use the new key, which is unnecessary since the original key exists and can simply be re-enabled. Option B (create a new KMS key and update the application to use it) is also a valid but more complex fix; however, the simplest and most direct solution is to re-enable the key. Option D (enable automatic key rotation) does not affect the disabled state; it only sets a rotation policy for future key updates.

Answer

Delete the key and recreate it

Answer

Create a new KMS key and update the application to use it

Answer

Enable automatic key rotation

Question 2

A developer receives the above error when trying to launch an EC2 instance. What is the most likely cause?

Accepted Answer

An SCP at the organizational level denies ec2:RunInstances. The error message explicitly mentions a service control policy (SCP) that denies the action, indicating that an SCP at the organizational level is blocking the ec2:RunInstances action. Option C is therefore correct. Option A is incorrect because instance limit errors show a message about reaching the maximum number of instances, not an SCP denial. Option B is incorrect because VPC restrictions typically produce errors related to network constraints, not an explicit SCP reference. Option D is incorrect because an IAM policy denial would result in an 'UnauthorizedOperation' error, not one mentioning SCP.

Answer

The account has reached its EC2 instance limit

Answer

The developer is trying to launch the instance in a restricted VPC

Answer

The developer's IAM policy does not allow ec2:RunInstances

Question 3

A developer is building a serverless application using AWS Lambda. The application needs to access a DynamoDB table and an S3 bucket. What is the MOST secure way to provide the necessary permissions?

Accepted Answer

Create an IAM role with appropriate policies and attach it to the Lambda function.. IAM roles for Lambda functions are the secure way to grant permissions without hardcoding credentials. Option B is wrong because resource-based policies are typically used for granting cross-account access, not for granting permissions to a Lambda function within the same account; IAM roles are the appropriate mechanism. Option C is wrong because inline policies cannot be attached directly to a Lambda function; Lambda uses IAM roles. Option D is wrong because storing AWS access keys in environment variables is insecure and should be avoided; IAM roles are preferred.

Answer

Use a resource-based policy on the DynamoDB table and S3 bucket to grant access to the Lambda function.

Answer

Attach an inline policy directly to the Lambda function resource.

Answer

Store AWS access keys in environment variables of the Lambda function.

Question 4

A company wants to encrypt data at rest in Amazon S3. Which AWS service can be used to manage the encryption keys?

Accepted Answer

AWS Key Management Service (KMS). AWS Key Management Service (KMS) is the service that manages encryption keys for Amazon S3's server-side encryption with KMS (SSE-KMS). Option A is wrong because AWS Certificate Manager (ACM) handles SSL/TLS certificates, not encryption keys for S3. Option B is wrong because AWS CloudHSM provides hardware-based key management but is not directly integrated with S3 for SSE; KMS is the managed service for this use case. Option C is wrong because AWS Identity and Access Management (IAM) controls access permissions, not encryption key management.

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Answer

AWS Identity and Access Management (IAM)

Question 5

A developer is tasked with rotating database credentials stored in AWS Secrets Manager for an RDS MySQL instance. The rotation must occur automatically every 30 days. What is the BEST approach?

Accepted Answer

Configure automatic rotation in Secrets Manager using a rotation Lambda function.. AWS Secrets Manager supports automatic rotation of secrets using a custom Lambda function. You can configure a rotation schedule (e.g., every 30 days) and Secrets Manager invokes the Lambda to update the secret in both Secrets Manager and the RDS database. Option A is incorrect because although Parameter Store can store credentials, it does not have built-in rotation; you would need to implement a scheduled Lambda manually, which is more effort. Option B is incorrect because RDS automatic password rotation changes the master password but does not automatically update the secret in Secrets Manager; you would have to manually synchronize. Option C is incorrect because IAM roles are used for IAM database authentication, not for rotating the database password stored in Secrets Manager; rotating role credentials does not change the password.

Answer

Store the credentials in AWS Systems Manager Parameter Store and use a scheduled Lambda to rotate them.

Answer

Use RDS automatic password rotation and have the application fetch the new password from RDS.

Answer

Use an IAM role for the RDS instance and rotate the role's credentials.

Question 6

A developer is creating a new IAM policy to allow an application to read objects from a specific S3 bucket and write logs to a CloudWatch log group. Which policy statement is correct?

Accepted Answer

{"Effect":"Allow","Action":["s3:GetObject","logs:CreateLogStream","logs:PutLogEvents"],"Resource":["arn:aws:s3:::my-bucket/*","arn:aws:logs:us-east-1:123456789012:log-group:MyLogGroup:*"]}. It grants the necessary permissions: s3:GetObject to read objects from the bucket, and logs:CreateLogStream and logs:PutLogEvents to write logs to the CloudWatch log group. The resources are correctly specified: the bucket ARN with a wildcard for objects, and the log group ARN with a wildcard for log streams. Option A is incorrect because it uses ec2:DescribeInstances, which is unrelated to S3 or CloudWatch. Option B is incorrect because it only allows s3:ListBucket on the bucket (listing objects) but not reading them (s3:GetObject), and it does not include CloudWatch actions. Option D is incorrect because it only allows s3:PutObject (writing objects) rather than reading, and lacks CloudWatch permissions.

Answer

{"Effect":"Allow","Action":["ec2:DescribeInstances"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":["s3:ListBucket"],"Resource":"arn:aws:s3:::my-bucket/*"}

Answer

{"Effect":"Allow","Action":["s3:PutObject"],"Resource":"arn:aws:s3:::my-bucket/*"}

Question 7

A developer needs to securely pass a secret API key to an AWS Lambda function. What is the MOST secure and recommended approach?

Accepted Answer

Store the API key in AWS Secrets Manager and retrieve it in the Lambda function code.. AWS Secrets Manager is a dedicated service for securely storing and managing secrets like API keys. It integrates natively with Lambda, allowing retrieval at runtime with minimal permissions using IAM roles. Option A (DynamoDB) is less secure because it requires managing encryption and access policies manually, and the secret might be exposed in query logs. Option B (hardcoding) is insecure as the key is visible in source code and version control. Option C (environment variables) can be viewed in the Lambda console and CloudWatch Logs, and they are not encrypted by default unless using encryption helpers. Therefore, Secrets Manager (Option D) is the most secure and recommended approach.

Answer

Store the API key in an Amazon DynamoDB table and query it from the Lambda function.

Answer

Hardcode the API key in the Lambda function code.

Answer

Store the API key in an environment variable of the Lambda function.

Question 8

A company is using AWS CodeCommit for source control. Developers need to access the repository from their local machines. Which authentication method is recommended for secure access?

Accepted Answer

Generate and use SSH keys paired with an IAM user.. SSH keys provide secure access without storing credentials on the machine and can be paired with an IAM user for CodeCommit. Option A is wrong because IAM user password is for console access, not Git. Option B is wrong because while access keys can be used for Git credentials, they are long-term credentials and less secure than SSH keys. Option C is wrong because Cognito is for end-user authentication, not developer access to CodeCommit.

Answer

Use IAM user name and password for Git credentials.

Answer

Use IAM access key and secret key for authentication.

Answer

Use Amazon Cognito user pools for authentication.

Question 9

A developer wants to encrypt data in transit between an application and an S3 bucket. Which option achieves this?

Accepted Answer

Use HTTPS when making requests to S3.. HTTPS encrypts data in transit between the application and S3, ensuring confidentiality during transmission. Option A is incorrect because SSE-S3 encrypts data at rest, not in transit. Option B is incorrect because IAM policies control access permissions, not encryption. Option D is incorrect because encrypting data with AWS KMS before upload addresses at-rest encryption, but without HTTPS, data is still transmitted in plaintext.

Answer

Enable server-side encryption with S3 managed keys (SSE-S3).

Answer

Configure an IAM policy to require encryption.

Answer

Use AWS KMS to encrypt the data before upload.

Question 10

A company has an S3 bucket with a policy that denies access to all users. The bucket owner wants to grant read access to a specific IAM user. What must be done?

Accepted Answer

Remove the Deny statement from the bucket policy.. An explicit deny in a bucket policy overrides any allow statement. Therefore, the only way to grant access is to remove or modify the deny statement. Option A is unnecessary as the existing bucket can be used if the policy is changed. Option B is incorrect because adding an Allow statement in the bucket policy does not override the existing explicit deny; the deny still takes precedence. Option D is incorrect because bucket ACLs are also overridden by explicit deny in the bucket policy.

Answer

Create a new bucket and copy objects there.

Answer

Add an Allow statement in the bucket policy for the user.

Answer

Add the user to the bucket ACL with read permission.

Question 11

A developer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket despite having an IAM role with the correct permissions attached. Which THREE steps should the developer take to diagnose the issue?

Accepted Answer

Check the security group of the EC2 instance for outbound rules.. Options B, C, and D are correct. Option B: Security group outbound rules must allow HTTPS (port 443) to reach S3; a missing outbound rule can block access. Option C: Checking for explicit Deny statements in the IAM policy helps identify if any deny is overriding the allow permissions. Option D: Verifying that the IAM role is correctly associated with the instance ensures the instance actually has the role attached. Option A is incorrect because 'aws sts assume-role' is used to assume a different role, not to test the instance's current role credentials; to validate the instance's role, you would use 'aws sts get-caller-identity'. Option E is incorrect because modifying the bucket policy to grant access to a security group is not a diagnostic step and bucket policies cannot grant access to security groups.

Answer

Use the AWS CLI command 'aws sts assume-role' to test the role credentials.

Answer

Modify the S3 bucket policy to grant access to the instance's security group.

Question 12

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to download an object from my-bucket that was uploaded without server-side encryption. What happens?

Accepted Answer

The request is denied because the object is not encrypted with SSE-KMS.. The IAM policy includes a condition that requires the request to include the `s3:x-amz-server-side-encryption` header set to `aws:kms`. For GetObject, this header is not part of the request, so the condition always fails and the request is denied. Option A is incorrect because the policy does not allow GetObject without satisfying the condition. Option C is incorrect because the policy is an IAM policy, not a bucket policy. Option D is incorrect because even though the policy allows the s3:GetObject action, the condition is not satisfied, so the request is denied.

Answer

The request succeeds because the condition only applies to PutObject.

Answer

The request is denied because the bucket policy requires encryption.

Answer

The request succeeds because the policy allows s3:GetObject.

Question 13

Refer to the exhibit. A developer in account 111111111111 tries to assume a role in account 123456789012. The error occurs. What is the MOST likely cause?

Accepted Answer

The user does not have sts:AssumeRole permission on the target role.. Cross-account role assumption requires a trust policy and an IAM policy granting sts:AssumeRole. Without the actual error shown in the exhibit, the cause cannot be definitively determined. An incorrect role ARN also often results in AccessDenied, not NoSuchEntity, so option D cannot be ruled out based solely on the error type.

Answer

The role does not exist in the us-east-1 region.

Answer

The access keys used are expired.

Answer

The role ARN is incorrect.

Question 14

A company is using an Application Load Balancer (ALB) to route traffic to a set of EC2 instances. The security team wants to ensure that only traffic from the ALB can reach the instances. Which security group configuration should be used?

Accepted Answer

Configure the EC2 instance security group to allow traffic from the ALB security group.. You can reference the security group of the ALB as the source in the EC2 instance security group rule. This ensures that only traffic from the ALB (which uses that security group) is allowed, regardless of the ALB's IP addresses. Option A is wrong because relying on the ALB's private IP address range is not recommended as IP addresses can change when the ALB scales or is replaced. Option B is wrong because network ACLs do not support security group IDs as sources; they operate at the subnet level and only support IP addresses. Option D is wrong because allowing all HTTP traffic from 0.0.0.0/0 would bypass the restriction and allow any source, defeating the purpose.

Answer

Configure the EC2 instance security group to allow traffic from the ALB's private IP address range.

Answer

Configure the network ACL for the EC2 instance subnet to allow traffic from the ALB security group.

Answer

Configure the EC2 instance security group to allow HTTP traffic from 0.0.0.0/0.

Question 15

A developer needs to grant an IAM user access to an S3 bucket for read-only operations. Which IAM policy action should be used?

Accepted Answer

s3:GetObject. S3:GetObject allows reading objects from S3, which is required for read-only operations. Option A (s3:PutObject) allows writing, option B (s3:DeleteObject) allows deletion, and option C (s3:ListBucket) allows listing bucket contents but not reading object content, so none of these provide read-only access.

Answer

s3:PutObject

Answer

s3:DeleteObject

Answer

s3:ListBucket