DVA-C02 Security Practice Test 4 — 15 Questions

Question 1

A company wants to store database credentials securely and rotate them automatically on a schedule. The credentials are used by an AWS Lambda function to access an Amazon RDS instance. Which AWS service should the developer use to meet these requirements?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule. It natively supports automatic rotation for Amazon RDS databases (including MySQL, PostgreSQL, Oracle, SQL Server, and MariaDB) by integrating with Lambda to update the credentials in both Secrets Manager and the RDS instance. This meets the requirement for both secure storage and scheduled rotation without custom infrastructure.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

AWS Certificate Manager (ACM)

Question 2

A developer needs to grant an IAM role in the same AWS account read-only access to objects in a specific S3 bucket. The bucket is configured with a bucket policy that has an explicit Deny statement denying all principals except the root user. Which approach should the developer use to grant the required access?

Accepted Answer

Modify the bucket policy to allow the IAM role explicitly, or remove the Deny statement. The bucket policy contains an explicit Deny that overrides any allow permissions, including those granted by an IAM policy attached to the role. To grant the IAM role read-only access, the developer must either remove the Deny statement or add an explicit Allow for the role in the bucket policy, because an explicit Deny in a resource-based policy cannot be overridden by an identity-based policy.

Answer

Attach an IAM policy to the role that allows s3:GetObject on the bucket

Answer

Use an S3 access point instead of the bucket directly

Answer

Make the bucket public to allow all access

Question 3

A developer needs to grant temporary access to an Amazon S3 bucket for a user from a different AWS account. The developer wants to use the most secure method that does not require sharing long-term credentials. Which approach should the developer take?

Accepted Answer

Use cross-account IAM roles with STS AssumeRole. Option C is correct because using cross-account IAM roles with AWS Security Token Service (STS) AssumeRole allows the external user to obtain temporary, limited-privilege credentials without sharing any long-term access keys. This approach follows the principle of least privilege and eliminates the risk of exposed static credentials, as the temporary credentials automatically expire after a configurable duration (default 1 hour, max 12 hours).

Answer

Create an IAM user in the developer's account and share the access keys

Answer

Use S3 bucket policy with a condition for the external account's IAM user

Answer

Use S3 access control lists (ACLs) with the external user's canonical user ID

Question 4

A developer needs to allow an IAM user in a different AWS account to assume a role in the developer's account. The role has permissions to access an S3 bucket. Which policy is required in the developer's account to enable this cross-account access?

Accepted Answer

An IAM role with a trust policy that allows the external account's root user or specific IAM users/roles to assume the role. Option A is correct because cross-account IAM role access requires a trust policy attached to the role in the developer's account. This trust policy specifies the external AWS account ID (or specific IAM users/roles in that account) as the principal, allowing them to call sts:AssumeRole. Once the role is assumed, the developer's account grants the necessary S3 permissions via the role's permissions policy.

Answer

An S3 bucket policy granting access to the external account

Answer

An IAM user policy in the external account allowing sts:AssumeRole

Answer

An AWS Organizations service control policy allowing cross-account access

Question 5

A developer runs an application on Amazon EC2 that needs to securely store database credentials (username and password). The security team requires that the credentials be automatically rotated every 30 days. Which AWS service should the developer use to store and automatically rotate the credentials?

Accepted Answer

AWS Secrets Manager with automatic rotation enabled.. AWS Secrets Manager is designed specifically for managing secrets such as database credentials, with built-in capabilities for automatic rotation according to a schedule (e.g., every 30 days). It integrates natively with supported databases (e.g., Amazon RDS, Redshift, DocumentDB) to rotate credentials without custom code, and it encrypts secrets at rest using AWS KMS. This makes it the correct choice for the developer's requirement of secure storage and automated rotation.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

AWS Identity and Access Management (IAM) roles for EC2.

Answer

AWS Key Management Service (KMS) to store the credentials as encrypted data.

Question 6

A developer stores database credentials for an application running on Amazon EC2. The security team requires that the credentials be automatically rotated every 30 days to reduce the risk of compromise. Which AWS service should the developer use to store and automatically rotate the credentials?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store database credentials and other secrets, and it provides built-in, configurable automatic rotation (e.g., every 30 days) using AWS Lambda. This meets the security team's requirement without custom scripting or infrastructure management.

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Answer

IAM Roles for EC2

Question 7

A company wants to enforce multi-factor authentication (MFA) for all users accessing the AWS Management Console. The company has an existing IAM setup with users and groups. Which approach should the developer recommend to enforce MFA?

Accepted Answer

Attach an IAM policy to each user that denies all actions unless the user has MFA present.. Option B is correct because it uses an IAM policy with a condition key (`aws:MultiFactorAuthPresent`) to deny all actions when MFA is not present. This is the standard AWS-recommended approach to enforce MFA for IAM users accessing the Management Console, as it applies a deny-all-except-MFA effect at the user level without requiring account-level changes.

Answer

Enable MFA at the account level using the AWS Account settings.

Answer

Enable MFA on the root user and require all users to use the root user credentials with MFA.

Answer

Create a new IAM group for MFA users and add users to that group.

Question 8

A company needs to grant another AWS account read-only access to an S3 bucket. The developer wants to use a bucket policy without requiring IAM users in the trusted account. Which resource-based policy statement should the developer add to the bucket?

Accepted Answer

A principal of 'arn:aws:iam::OTHER-ACCOUNT-ID:root' with s3:GetObject and s3:ListBucket.. Option D is correct because it uses the root user ARN of the trusted account as the principal, which effectively grants permissions to all IAM users and roles in that account. The s3:GetObject and s3:ListBucket actions provide the required read-only access. This approach allows cross-account access without needing to create IAM users in the trusted account, as the bucket policy is a resource-based policy that directly authorizes the principal.

Answer

A principal of the root user of the other account with s3:GetObject.

Answer

A principal of any user with a condition for the account ID.

Answer

A principal of the other account's root ARN with s3:ListBucket and s3:GetObject.

Question 9

A company runs an application on Amazon EC2 instances that need to read data from an Amazon DynamoDB table. The developer must grant access to DynamoDB without storing any long-term credentials on the instance. Which approach should the developer use?

Accepted Answer

Use an IAM role and attach it to the EC2 instance profile.. Option B is correct because attaching an IAM role to an EC2 instance profile allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS) via the instance metadata service. This eliminates the need to store long-term credentials on the instance, adhering to the principle of least privilege and improving security posture.

Answer

Store the AWS access key and secret key in a configuration file.

Answer

Use an IAM user and store credentials in AWS Secrets Manager.

Answer

Use the DynamoDB table's resource-based policy to allow the EC2 instance.

Question 10

A company wants to restrict access to an Amazon S3 bucket so that only requests originating from a specific Amazon VPC are allowed. The bucket is in the same AWS account as the VPC. Which configuration should the developer implement?

Accepted Answer

Bucket policy with condition aws:SourceVpc. Option A is correct because the `aws:SourceVpc` condition key in an S3 bucket policy allows you to restrict access to requests originating from a specific VPC. This works in conjunction with a VPC endpoint for S3 (Gateway or Interface endpoint), which ensures that traffic from the VPC to S3 stays within the AWS network and does not traverse the public internet. The condition evaluates the VPC ID from which the request originates, providing a secure, network-level access control.

Answer

Bucket policy with condition aws:SourceIp

Answer

Bucket ACL with VPC ID

Answer

VPC Endpoint policy

Question 11

A developer is creating a web application that uses Amazon Cognito for user authentication. The application needs to verify the identity of users before allowing access to the API. Which Cognito feature should the developer use?

Accepted Answer

User Pools. Amazon Cognito User Pools provide a fully managed identity and access management service specifically designed for user authentication and authorization in web and mobile applications. They handle user sign-up, sign-in, and identity verification through features like multi-factor authentication (MFA) and JSON Web Token (JWT) issuance, making them the correct choice for verifying user identity before granting API access.

Answer

Identity Pools

Answer

Cognito Sync

Answer

Cognito Events

Question 12

A developer is building a REST API with Amazon API Gateway and needs to authorize requests based on a custom JSON Web Token (JWT) that includes claims for user roles. Which authorization mechanism should the developer use?

Accepted Answer

Lambda authorizer. A Lambda authorizer (formerly known as a custom authorizer) is the correct choice because it allows the developer to validate a custom JWT and extract claims such as user roles directly within the Lambda function. This enables fine-grained authorization logic that can inspect the JWT payload, verify its signature using a custom or third-party key, and return an IAM policy based on the claims, which API Gateway then enforces for the incoming request.

Answer

IAM authorizer

Answer

Amazon Cognito user pools authorizer

Answer

API Gateway resource policy

Question 13

A developer wants to grant a user in a different AWS account access to an S3 bucket. The developer has written a bucket policy that allows the user's IAM user ARN. However, the access is still denied. What is the most likely reason?

Accepted Answer

The user's IAM user policy does not explicitly allow the required S3 action. When granting cross-account access to an S3 bucket, both the bucket policy (resource-based policy) and the user's IAM policy (identity-based policy) must explicitly allow the action. The bucket policy alone is insufficient if the user's IAM policy does not include an explicit Allow for the S3 action, because IAM denies by default. Even though the bucket policy grants access, the user's own IAM policy must also permit the operation for the request to succeed.

Answer

The bucket policy does not have a principal of '*' to allow external accounts

Answer

The bucket is in a different region than the user's account

Answer

The user is using the wrong S3 endpoint (e.g., path-style vs virtual-hosted)

Question 14

A company wants to ensure that no Amazon S3 buckets in the AWS account can be made publicly accessible, even if a bucket policy or ACL is later configured to allow public access. Which AWS feature should the developer enable to enforce this at the account level?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is the correct choice because it provides account-level settings that override any bucket-level policies or ACLs that would grant public access. When enabled at the account level, these settings apply to all current and future S3 buckets, effectively preventing any bucket from becoming publicly accessible regardless of subsequent configuration changes.

Answer

S3 Object Lock

Answer

S3 Transfer Acceleration

Answer

S3 Bucket Policy with Deny clause

Question 15

A developer is building a REST API using API Gateway and AWS Lambda. The API must only be accessible by authenticated users who belong to a specific group within an Amazon Cognito user pool. Which API Gateway authorization mechanism should the developer use?

Accepted Answer

Amazon Cognito User Pool authorizer. The Amazon Cognito User Pool authorizer is the correct choice because it directly integrates with Cognito user pools to validate JWT tokens issued by the pool. This allows the developer to restrict access to only authenticated users who belong to a specific group within the user pool, as group membership is encoded in the JWT claims.

Answer

AWS IAM authorization

Answer

Lambda authorizer

Answer

API key