DVA-C02 Security Practice Test 4 — 15 Questions

Question 1

A company has an S3 bucket configured with server-side encryption using AWS KMS (SSE-KMS). An application running on EC2 with an appropriate IAM role is unable to write objects to the bucket. The error message indicates an access denied error. Which additional permission is most likely required?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

kms:GenerateDataKey. Kms:GenerateDataKey. With SSE-KMS, when writing an object, S3 calls KMS to generate a data key for encryption. The IAM role must have the kms:GenerateDataKey permission. kms:Decrypt (B) is for reading objects. kms:Encrypt (C) is for client-side encryption, not used by S3 server-side. kms:ReEncrypt (D) is for re-encrypting data keys.

Answer

kms:Decrypt

Answer

kms:Encrypt

Answer

kms:ReEncrypt

Question 2

A developer is building a serverless application using AWS Lambda and needs to securely store database credentials. Which AWS service should be used to store and retrieve the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is specifically designed to securely store and automatically rotate secrets such as database credentials. Option A is wrong because AWS CloudFormation is an infrastructure as code service, not a secret store. Option C is wrong because AWS Systems Manager Parameter Store can store parameters but lacks automatic rotation and is not as feature-rich for secrets management. Option D is wrong because AWS KMS is for managing encryption keys, not storing credentials directly.

Answer

AWS CloudFormation

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Question 3

A company wants to encrypt data at rest in an Amazon RDS for PostgreSQL database. The database is already running, and the company wants to enable encryption without significant downtime. Which approach should be taken?

Accepted Answer

Take a snapshot, copy the snapshot with encryption, and restore a new encrypted instance from the encrypted snapshot.. To encrypt an existing unencrypted RDS for PostgreSQL instance, you must take a snapshot, copy the snapshot with encryption enabled (using a KMS key), and then restore a new encrypted instance from that snapshot. This approach minimizes downtime because the snapshot operation is online and the restore creates a new instance. Option A is incorrect because taking a snapshot alone does not enable encryption; you must copy it with encryption. Option C is incorrect because you cannot modify an existing RDS instance to enable encryption directly. Option D is incorrect because you cannot create an encrypted read replica from an unencrypted source, and promoting a replica would not encrypt the original instance.

Answer

Take a snapshot of the database and enable encryption on the snapshot.

Answer

Modify the RDS instance and enable encryption in the configuration.

Answer

Create a read replica with encryption and promote it.

Question 4

A developer needs to allow an IAM user to stop and start EC2 instances but not terminate them. Which IAM policy effect and action combination should be used?

Accepted Answer

Allow ec2:StopInstances and ec2:StartInstances. It explicitly allows ec2:StopInstances and ec2:StartInstances, which grants the needed permissions without allowing ec2:TerminateInstances. Option B is incorrect because it includes ec2:TerminateInstances, which would allow termination, contrary to the requirement. Option C is incomplete: although it denies ec2:TerminateInstances, it does not allow ec2:StopInstances or ec2:StartInstances, so the user would not have the required start/stop permissions. Option D is incorrect because it allows ec2:TerminateInstances.

Answer

Allow ec2:StopInstances, ec2:StartInstances, and ec2:TerminateInstances

Answer

Deny ec2:TerminateInstances

Answer

Allow ec2:StartInstances and ec2:TerminateInstances

Question 5

A company is using Amazon Cognito for user authentication. The developers need to add multi-factor authentication (MFA) for security. Which Cognito feature should be enabled?

Accepted Answer

Cognito User Pools with MFA configuration. Amazon Cognito User Pools support multi-factor authentication (MFA) configurations, including SMS and TOTP. Option A is incorrect because Cognito Sync is used for synchronizing user data across devices, not for authentication or MFA. Option C is incorrect because Developer Authenticated Identities is a feature for custom authentication flows, not directly for enabling MFA. Option D is incorrect because Cognito Identity Pools provide federated identities for accessing AWS resources, but MFA is configured at the User Pool level.

Answer

Cognito Sync

Answer

Cognito Developer Authenticated Identities

Answer

Cognito Identity Pools

Question 6

A developer is troubleshooting an issue where an S3 bucket policy is not granting cross-account access to a user in another AWS account. The bucket policy uses a Principal element with the AWS account ID. What is the most likely reason for the failure?

Accepted Answer

The IAM user in the other account does not have an IAM policy that allows the S3 action.. For cross-account access, both the bucket policy (in the account owning the bucket) and the IAM user's policy (in the requesting account) must grant the necessary permissions. Even if the bucket policy allows access to the other account's root or specific user, the IAM user must have an explicit IAM policy allowing the S3 action. Without that, the request is denied. Option A is incorrect because SSE-S3 encryption does not inherently block cross-account access; permissions are still evaluated. Option B is incorrect because using the user's ARN is not required; the bucket policy can use the account ID to grant access to all users in that account, but the user still needs an IAM policy. Option C is incorrect because bucket policies can grant access to users in another account, but it must be combined with appropriate IAM policies.

Answer

The bucket is encrypted with SSE-S3, which blocks cross-account access.

Answer

The bucket policy must use the user's ARN instead of the account ID.

Answer

The bucket policy cannot grant access to users in another account.

Question 7

A company wants to ensure that all data in transit between a web application and its users is encrypted. Which AWS service can provide SSL/TLS termination?

Accepted Answer

Application Load Balancer (ALB). Application Load Balancer (ALB). ALB can terminate SSL/TLS, decrypt traffic, and forward it to backend targets. Option A (Amazon CloudFront) also provides SSL termination, but the question asks for a service that can provide SSL/TLS termination within a VPC, making ALB the typical choice. Option C (Amazon Route 53) is a DNS service and does not terminate SSL. Option D (Amazon EC2 instance) can handle SSL termination if configured, but it is not a managed service; the question asks for an AWS service, so EC2 is not the best answer.

Answer

Amazon CloudFront

Answer

Amazon Route 53

Answer

Amazon EC2 instance

Question 8

Which TWO services can be used to encrypt data at rest in Amazon S3? (Choose two.)

Accepted Answer

SSE-KMS. Options A and E are correct. Option A: SSE-KMS uses AWS Key Management Service (KMS) for managing encryption keys, providing additional control and audit capabilities. Option E: SSE-S3 uses S3-managed keys for encryption at rest. Option B is incorrect because AWS IAM is an access management service, not an encryption service. Option C is incorrect because AWS Certificate Manager (ACM) handles SSL/TLS certificates, not data encryption. Option D is incorrect because AWS CloudHSM provides hardware security modules but is not directly integrated with S3 for encryption.

Answer

AWS IAM

Answer

AWS Certificate Manager (ACM)

Answer

AWS CloudHSM

Question 9

A company is using an S3 bucket to store sensitive data. They want to ensure that all objects uploaded to the bucket are encrypted at rest using server-side encryption with AWS KMS (SSE-KMS). What is the most secure way to enforce this?

Accepted Answer

Create a bucket policy that denies PutObject unless the x-amz-server-side-encryption header is set to aws:kms.. An S3 bucket policy with a condition that denies PutObject requests unless the x-amz-server-side-encryption header is set to 'aws:kms' ensures that any upload without SSE-KMS is rejected. This policy cannot be overridden by the uploader, providing a strong enforcement mechanism. Option A is wrong because default encryption can be overridden by the uploader's request headers. Option B is wrong because denying PutObject without any encryption would still allow other encryption types like SSE-S3 or SSE-C, not specifically SSE-KMS. Option D is wrong because S3 Block Public Access does not enforce any encryption; it only prevents public access.

Answer

Enable default encryption on the bucket with SSE-KMS.

Answer

Create a bucket policy that denies PutObject without encryption.

Answer

Enable S3 Block Public Access on the bucket.

Question 10

A developer is troubleshooting access to an S3 bucket from an EC2 instance. The instance has an IAM role with an attached policy that allows s3:GetObject on the bucket. However, the application is receiving Access Denied errors. What is a likely cause?

Accepted Answer

The bucket policy has an explicit deny that overrides the IAM allow.. If the bucket policy explicitly denies access, the deny overrides any allow from IAM. Option A is wrong because S3 does not require S3 Block Public Access for IAM role access. Option B is wrong because the instance profile needs an IAM role, not an IAM user. Option D is wrong because S3 does not require the s3:ListBucket permission to get an object if you know the key.

Answer

The IAM role does not have s3:ListBucket permission.

Answer

The EC2 instance is not associated with an instance profile.

Answer

The bucket has S3 Block Public Access enabled.

Question 11

A developer needs to securely store database credentials for an application running on AWS Lambda. Which AWS service should they use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the appropriate service for securely storing database credentials because it is designed specifically for secrets management, with built-in automatic rotation and fine-grained access control. AWS Systems Manager Parameter Store can store secrets but lacks automatic rotation and is less secure for sensitive credentials. AWS CloudHSM provides hardware security modules for key generation, not for storing secrets. AWS Systems Manager Session Manager is for interactive shell access to instances, not for secret storage.

Answer

AWS Systems Manager Session Manager

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store (Standard tier)

Question 12

A company is using AWS KMS to encrypt data in S3. They want to ensure that only specific IAM roles can decrypt the data, even if the IAM role has full S3 access. What should they do?

Accepted Answer

Modify the KMS key policy to grant decrypt permission only to the specific IAM role.. A KMS key policy can grant decrypt permission to specific IAM roles, ensuring only those roles can decrypt even if they have full S3 access. Option A is incorrect because an IAM policy denying KMS Decrypt for all except the role is not the best practice; KMS key policies are more direct for key-level permissions. Option B is incorrect because bucket policies control S3 actions, not KMS decrypt. Option C is incorrect because S3 Block Public Access does not affect KMS operations.

Answer

Use an IAM policy to deny KMS Decrypt for all users except the role.

Answer

Add a bucket policy that denies Decrypt for all principals except the role.

Answer

Enable S3 Block Public Access on the bucket.

Question 13

A developer is building an application that uploads files to S3. The application uses an IAM user with access keys. The developer wants to rotate the access keys regularly. Which approach is the most secure?

Accepted Answer

Use AWS Secrets Manager to automatically rotate the access keys.. Using AWS Secrets Manager to automatically rotate IAM user access keys is the most secure approach. It eliminates human error, enforces rotation on a schedule, and can be integrated with the application without manual intervention. Option B is incorrect because root account access keys are a security risk and should never be used for applications. Option C is incorrect because manually creating new keys every 90 days is error-prone and less secure than automated rotation. Option D is incorrect because creating a new IAM user does not rotate the existing user's keys; it requires updating the application with new credentials, which is also insecure.

Answer

Use the root account access keys and rotate them manually.

Answer

Manually create new keys every 90 days and update the application.

Answer

Create a new IAM user and update the application.

Question 14

A developer is configuring a load balancer in front of an EC2 instance running a web application. The application needs to authenticate users via an identity provider. Which AWS service should the developer use to handle authentication and authorization?

Accepted Answer

Amazon Cognito. Amazon Cognito provides user pools for authentication and can be integrated with an Application Load Balancer. Option A is wrong because IAM is for AWS API access, not web app users. Option C is wrong because CloudFront is a CDN. Option D is wrong because Route 53 is DNS.

Answer

AWS Identity and Access Management (IAM)

Answer

Amazon Route 53

Answer

Amazon CloudFront

Question 15

A company wants to encrypt data in transit between an EC2 instance and an S3 bucket. What should they do?

Accepted Answer

Use the S3 HTTPS endpoint for all API calls.. Data in transit between EC2 and S3 is encrypted by using the S3 HTTPS endpoint for all API calls, which uses TLS/SSL to encrypt the connection. Option A is incorrect because S3 does not support SSH transfers; SSH is used for secure shell access, not for S3 API calls. Option B is incorrect because S3 does not support VPN connections; VPN is used for network-level encryption between on-premises networks and AWS, not directly between EC2 and S3. Option C is incorrect because client-side encryption encrypts data before sending, but it does not address encryption in transit; HTTPS is the standard for in-transit encryption, and client-side encryption is for data at rest on the client side.

Answer

Use SSH to transfer files to S3.

Answer

Establish a VPN connection between the instance and S3.

Answer

Enable client-side encryption using the AWS SDK.