DVA-C02 Security Practice Test 4 — 15 Questions

Question 1

A company is using AWS CloudTrail to monitor API activity. A developer notices that some actions are not logged. What is a possible reason?

Accepted Answer

Some services are not integrated with CloudTrail.. CloudTrail does not log all AWS services by default; some services must be enabled separately.

Answer

CloudTrail only logs read events.

Answer

CloudTrail has a 24-hour delay.

Answer

The CloudTrail trail is not enabled in the correct region.

Question 2

A developer attaches this IAM policy to an IAM user. The user is trying to access an object in example-bucket from an IP address 203.0.113.5. What will happen?

Accepted Answer

Access is denied because the condition is not satisfied.. The policy allows access only from the 192.0.2.0/24 range. The user's IP 203.0.113.5 is outside that range, so access is implicitly denied.

Answer

Access is allowed because the condition is not mandatory.

Answer

Access is denied because the resource ARN is incorrect.

Answer

Access is allowed because the policy allows the action.

Question 3

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be rotated automatically every 12 months. Which type of KMS key should be used?

Accepted Answer

AWS managed key. AWS managed keys automatically rotate every 12 months (approximately 365 days) without any user action, and this rotation is mandatory and cannot be disabled. Customer managed keys also support automatic rotation, but the rotation period is configurable (90–2560 days) and must be explicitly enabled. Since the requirement is specifically for automatic rotation every 12 months with no mention of custom rotation control, the AWS managed key is the correct choice.

Answer

Custom key store (CloudHSM)

Answer

AWS owned key

Answer

Customer managed key

Question 4

A company uses AWS Secrets Manager to store database credentials. The application runs on Amazon EC2 instances with an IAM role attached. How should the application retrieve the secret securely?

Accepted Answer

Store the secret ID in an environment variable and use the AWS SDK to retrieve it. The best practice is to use the IAM role to call Secrets Manager APIs. The role must have a policy allowing secretsmanager:GetSecretValue. The application can then retrieve the secret at runtime using the AWS SDK.

Answer

Use AWS Systems Manager Parameter Store with a secure string parameter

Answer

Store the secret in an S3 bucket with server-side encryption

Answer

Hardcode the secret in the application code

Question 5

A developer attached the managed policy above to an IAM role used by an application. The application tries to decrypt data using a KMS key that has an encryption context of {"department": "finance"}. However, the request fails with access denied. What is the most likely reason?

Accepted Answer

The KMS key policy does not grant decrypt permission to the IAM role. KMS decryption requires permission from BOTH the IAM identity-based policy AND the KMS key policy (unless the key policy delegates to IAM). Even if the attached managed policy allows kms:Decrypt, the request fails with AccessDenied if the KMS key policy does not grant the IAM role access to that key. The question states the request fails despite the managed policy, so the missing grant is on the key policy side.

Answer

The IAM role does not have permission to call kms:Decrypt on any key

Answer

The encryption context does not match the condition

Answer

The IAM policy does not allow the kms:Decrypt action

Question 6

The above resource-based policy is attached to an SQS queue. An application running on an EC2 instance with the IAM role 'AppRole' tries to send a message to the queue but receives an access denied error. What is the most likely cause?

Accepted Answer

The IAM role does not have an identity-based policy allowing sqs:SendMessage. The resource-based policy allows the role to send messages, but the role itself must also have an IAM policy that allows sqs:SendMessage. Without that, the request is denied because both the identity-based policy and the resource-based policy must grant access (unless one is an explicit deny).

Answer

The SQS queue is encrypted with a KMS key that the role cannot use

Answer

The principal ARN in the policy is incorrect

Answer

The SQS queue policy does not include the correct region

Question 7

A company is using AWS Secrets Manager to rotate database credentials automatically. The rotation Lambda function fails with a timeout error after 30 seconds. The developer checked the Lambda logs and saw that the function is making network calls to the database but never receives a response. What is the MOST likely cause?

Accepted Answer

The Lambda function is not attached to a VPC with a NAT gateway or VPC endpoints for Secrets Manager.. The most likely cause. When a Lambda function is configured to access a VPC, it loses internet connectivity by default unless the VPC has a NAT gateway or VPC interface endpoints. The Secrets Manager rotation Lambda needs to call the Secrets Manager API (which is outside the VPC) to retrieve the new secret. Without a NAT gateway or VPC endpoints, the call to Secrets Manager times out, and because the function is also trying to connect to the database (which may be in the same VPC or reachable), the entire function times out after 30 seconds. Option A is incorrect because insufficient memory would cause performance issues or out-of-memory errors, not network timeouts. Option B is incorrect because the timeout is 30 seconds, which is already quite long; increasing it further would not resolve the underlying connectivity issue. Option D is incorrect because if the credentials were incorrect, the database would reject the connection immediately, not cause a timeout; the function would get an authentication error rather than a timeout.

Answer

The Lambda function memory is insufficient; increase memory to 1024 MB.

Answer

The Lambda function timeout is set too low; increase it to 5 minutes.

Answer

The database credentials are incorrect; the rotation function cannot authenticate.

Question 8

A developer wants to grant an IAM user permissions to list all S3 buckets in the account, but deny access to a specific bucket named 'confidential-data'. Which IAM policy should be attached?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:ListBucket","Resource":"arn:aws:s3:::confidential-data"}]}. The correct policy must allow s3:ListAllMyBuckets on all resources and explicitly deny s3:ListBucket on the specific bucket 'confidential-data' using its ARN. Option C does this by specifying the resource as 'arn:aws:s3:::confidential-data', which is the correct ARN format for an S3 bucket. The deny statement ensures that even if other policies allow access, this explicit deny overrides.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:ListBucket","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:ListBucket","Resource":"confidential-data"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::confidential-data"}]}

Question 9

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated automatically every year. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Use an AWS managed key (aws/s3) for S3 encryption.. AWS managed keys (aws/s3) are automatically rotated every year by AWS with no customer action, meeting the annual rotation requirement with zero operational overhead. Because the key is managed by AWS, the customer does not configure or maintain rotation. This is the least-effort solution.

Answer

Use a customer managed key and enable automatic rotation.

Answer

Create a customer managed key and rotate it manually every year.

Answer

Use an asymmetric KMS key and rotate it automatically.

Question 10

A developer is deploying a web application on EC2 instances behind an Application Load Balancer. The application needs to authenticate users via a third-party identity provider (IdP) that supports OpenID Connect (OIDC). The developer wants to offload authentication to the ALB. Which configuration is required?

Accepted Answer

Register the third-party IdP as an OIDC identity provider in IAM, then configure the ALB listener rule to authenticate users using that provider.. ALB can authenticate users via OIDC by configuring a listener rule that uses an OIDC identity provider. The developer must register the third-party IdP as an OIDC identity provider in IAM, then configure the ALB listener rule to use that provider. Option A is incorrect because installing an OIDC client on EC2 instances would require the application to handle authentication itself, which the developer wants to offload to the ALB. Option B is incorrect because although Amazon Cognito can be integrated with ALB, it is an additional service; the third-party IdP already supports OIDC, so Cognito is not required. Option D is incorrect because IAM roles are for granting permissions to AWS services, not for user authentication via ALB.

Answer

Install and configure an OIDC client on the EC2 instances.

Answer

Configure Amazon Cognito as an identity provider and integrate with the ALB.

Answer

Create an IAM role for the EC2 instances that allows them to assume the identity of the user.

Question 11

A company wants to store sensitive data in S3. The data must be encrypted at rest using server-side encryption with a key that is automatically rotated annually. Which S3 encryption option should be used?

Accepted Answer

SSE-S3. SSE-S3 (Option B). SSE-S3 uses AWS-managed keys that are automatically rotated annually, meeting the requirement for automatic key rotation. Option A (client-side encryption) is not server-side. Option C (SSE-KMS with a customer managed key) requires you to manage key rotation, which is not automatic annually. Option D (SSE-C) uses customer-provided keys and does not manage rotation.

Answer

Client-side encryption

Answer

SSE-KMS with a customer managed key

Answer

SSE-C

Question 12

A company uses IAM roles to grant permissions to EC2 instances. The security team notices that an instance is using a role that has administrator privileges, which is a security risk. What is the BEST way to restrict the instance's permissions without disrupting the application?

Accepted Answer

Create a new IAM role with only required permissions, attach it to the instance profile, and update the instance to use the new profile.. The best approach is to create a new least-privilege IAM role, attach it to the instance profile, and update the instance to use the new profile, which restricts permissions without disrupting the application. This follows least privilege while maintaining service continuity.

Answer

Remove the existing role from the instance and let the application fail.

Answer

Modify the trust policy of the existing role to deny access to the instance.

Answer

Attach a permissions boundary to the existing role that limits the maximum permissions.

Question 13

A developer is using AWS KMS to encrypt data. Which of the following are true about customer master keys (CMKs)? (Choose TWO.)

Accepted Answer

Customer managed keys can be rotated automatically every year.. Options D and E are correct. Customer managed keys (CMKs) can be created and managed by the user, and automatic yearly rotation can be enabled. AWS managed keys cannot be rotated by the customer, cannot be disabled or re-enabled, and incur per-request charges. Option A is incorrect because AWS managed keys cannot be disabled or re-enabled. Option B is incorrect because customer managed keys can be created by users. Option C is incorrect because AWS managed keys incur per-request charges.

Answer

You can disable and re-enable AWS managed keys.

Answer

You cannot create customer managed keys; only AWS can create them.

Answer

AWS managed keys are free with no usage charges.

Question 14

A company is deploying a web application on EC2 instances behind an ALB. The application needs to authenticate users using a corporate identity provider that supports SAML 2.0. Which of the following are required to configure this? (Choose THREE.)

Accepted Answer

Obtain the IdP's metadata document to configure the trust.. Option A is correct because configuring SAML federation requires exchanging metadata between AWS and the corporate IdP; the IdP's metadata document contains the entity ID, SSO URL, and signing certificate needed to establish the trust. Option B is correct because in AWS you must create a SAML identity provider in IAM (iam create-saml-provider) using that metadata, which makes AWS the service provider that trusts the corporate IdP's assertions. Option E is correct because an Application Load Balancer supports the authenticate-oidc and authenticate-saml actions; an ALB listener rule with an authenticate-saml action referencing the IAM SAML provider enforces authentication before forwarding traffic to the EC2 targets. Option C is not required because Cognito is an alternative user-pool/federation mechanism, not a prerequisite for ALB SAML authentication. Option D is incorrect because Route 53 is a DNS service and has no role in registering or trusting a SAML identity provider.

Answer

Configure Amazon Cognito as an intermediary.

Answer

Register the corporate IdP in Amazon Route 53.

Question 15

Refer to the exhibit. A developer attached this bucket policy to an S3 bucket named 'my-bucket'. The IAM role 'AppRole' is used by an application running on EC2 instances with an IP address of 192.0.2.10. The application tries to upload an object to 'my-bucket/confidential/report.pdf'. Will the upload succeed?

Accepted Answer

Yes, because the Deny statement uses a condition that does not match the application's IP.. The Deny statement in the bucket policy denies s3:PutObject on the 'confidential/' prefix with a condition that the source IP must not be from 192.0.2.0/24. Since the application's IP (192.0.2.10) is within that range, the condition is not met, so the Deny does not apply. The Allow statement grants s3:PutObject on the entire bucket, so the upload succeeds. Therefore, option D is correct. Option A is incorrect because the application already has the necessary permission via the bucket policy, and no additional IAM policy is required for the bucket policy to take effect. Option B is incorrect because the Deny does not apply due to the IP condition. Option C is incorrect because the Allow applies and the Deny does not.

Answer

Yes, but only if the application also has an IAM policy that allows s3:PutObject.

Answer

No, because the Deny statement denies all s3 actions on the 'confidential/' prefix.

Answer

No, because the Allow statement only allows GetObject and PutObject on the entire bucket, but the Deny overrides.