DVA-C02 Security Practice Test 5 — 15 Questions

Question 1

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to download an object from 'example-bucket' from an IP address of 10.0.1.5. Will the download succeed?

Accepted Answer

Yes, because the source IP matches the condition.. The policy allows s3:GetObject on the bucket when the source IP is within 10.0.0.0/16. The user's IP 10.0.1.5 is within that range. Option B is incorrect because the IP is in the allowed range. Option C is incorrect because the condition is met. Option D is incorrect because the policy is sufficient.

Answer

No, because the policy does not specify the user's IP.

Answer

Yes, but only if the bucket policy also allows the access.

Answer

No, because the condition requires the IP to be in 10.0.0.0/16.

Question 2

A developer is troubleshooting an application that uses an IAM role to access DynamoDB. The application is running on an EC2 instance and intermittently fails with an AccessDenied error. The IAM role has the following policy attached. What is the MOST likely cause?

Accepted Answer

The condition key aws:SourceIp might be blocking requests from the EC2 instance's IP.. The IAM policy allows all DynamoDB actions (dynamodb:*) on all tables, so the AccessDenied error is not due to missing actions or resource ARN. However, the condition `aws:SourceIp` restricts requests to specific IP addresses. If the EC2 instance's IP changes (e.g., due to NAT, Elastic IP reassignment, or scaling), the condition may deny access intermittently. Option C is correct.

Answer

The policy does not include the dynamodb:PutItem action.

Answer

The policy uses a NotAction element that inadvertently denies access.

Answer

The policy is missing the table ARN in the Resource field.

Question 3

A developer needs to securely store database credentials for a serverless application. Which service should be used?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is purpose-built for securely storing, managing, and automatically rotating secrets such as database credentials. Option A is wrong because Amazon S3 with server-side encryption is a general object storage service and lacks features like automatic rotation and fine-grained access control for secrets. Option B is wrong because AWS IAM manages identities and permissions, not secrets. Option C is wrong because AWS Systems Manager Parameter Store can store parameters but does not provide automatic rotation of secrets, which is a key requirement for database credentials.

Answer

Amazon S3 with server-side encryption.

Answer

AWS Identity and Access Management (IAM).

Answer

AWS Systems Manager Parameter Store.

Question 4

A company's S3 bucket contains sensitive data. The security team requires that all data be encrypted at rest. Which combination of actions will enforce encryption for all objects written to the bucket?

Accepted Answer

Enable default encryption on the bucket and apply a bucket policy that denies PutObject if the x-amz-server-side-encryption header is missing or set to None.. It combines enabling default encryption on the bucket with a bucket policy that denies PutObject requests when the x-amz-server-side-encryption header is missing or set to 'None'. This ensures that any object uploaded without encryption headers is rejected, and default encryption applies when the header is present but no encryption type is specified. Option B is incorrect because bucket ACLs cannot enforce encryption; they only grant permissions at the bucket or object level. Option C is incorrect because bucket ACLs alone cannot enforce encryption across all uploads. Option D is incorrect because a KMS key policy controls who can use the key, not whether encryption is applied during uploads.

Answer

Use bucket ACLs to grant write access only to users who use encryption.

Answer

Enable default encryption on the bucket and use bucket ACLs to restrict access.

Answer

Create an AWS KMS key and attach a key policy that requires encryption.

Question 5

A developer is building a serverless application using AWS Lambda and API Gateway. The API should be accessible only from a specific VPC. What is the MOST secure way to achieve this?

Accepted Answer

Create a VPC endpoint for API Gateway and attach a resource policy to the API that allows access only from the VPC endpoint.. The most secure way to restrict API Gateway access to a specific VPC is to create a VPC endpoint (Interface endpoint powered by AWS PrivateLink) for API Gateway and attach a resource policy to the API that allows only that VPC endpoint. This keeps traffic on the AWS private network, avoids public internet exposure, and enforces access at the API level via the resource policy's aws:sourceVpce condition.

Answer

Attach a security group to the API Gateway that only allows traffic from the VPC.

Answer

Create a private API Gateway endpoint and associate it with the VPC.

Answer

Set up VPC Peering between the VPC and the API Gateway's VPC.

Question 6

A developer wants to allow an IAM user to rotate their own access keys. Which IAM policy action should be included?

Accepted Answer

iam:CreateAccessKey. To allow an IAM user to rotate their own access keys, the IAM policy must grant permissions for several actions: `iam:CreateAccessKey` (to create the new key), `iam:UpdateAccessKey` (to deactivate the old key), `iam:DeleteAccessKey` (to delete the old key), and `iam:ListAccessKeys` (to view existing keys). By replacing the incorrect options with unrelated IAM actions (such as `iam:CreateUser`, `iam:GetUser`, and `iam:PassRole`), `iam:CreateAccessKey` becomes the single clearly correct answer among the choices.

Answer

iam:UpdateAccessKey

Answer

iam:GetAccessKeyLastUsed

Answer

iam:DeleteAccessKey

Question 7

A company is using AWS CloudTrail to monitor API activity. Which TWO actions are required to ensure the integrity and security of the log files?

Accepted Answer

Enable log file validation.. Options A and E are correct because enabling log file validation creates a digest file for integrity, and using SSE-KMS encrypts the logs. Option B is wrong because MFA Delete is an additional security feature for S3 versioning, but it is not required for CloudTrail log integrity. Option C is wrong because S3 bucket versioning is not a requirement for CloudTrail; it can be enabled but does not directly ensure integrity. Option D is wrong because using an S3 VPC endpoint is not required; CloudTrail can operate without it.

Answer

Enable MFA Delete on the CloudTrail S3 bucket.

Answer

Enable S3 bucket versioning on the CloudTrail bucket.

Answer

Use an S3 VPC endpoint to access the CloudTrail bucket.

Question 8

A developer is designing a system that stores sensitive user data in DynamoDB. The data must be encrypted at rest and in transit. Which THREE actions should the developer take?

Accepted Answer

Enable DynamoDB encryption at rest using an AWS KMS managed key (SSE-KMS).. Option A is correct because DynamoDB encryption at rest is enabled by default using an AWS owned key, but the developer can explicitly configure server-side encryption with an AWS KMS managed key (SSE-KMS) to meet compliance requirements for sensitive data. Option B is also correct because using an AWS KMS customer managed key gives the developer full control over the key lifecycle, rotation, and access policies, which is often required for sensitive user data. Option C is correct because all DynamoDB API calls should be made over HTTPS, which encrypts data in transit using TLS and is the standard secure endpoint for DynamoDB. Option D is not marked correct because while TLS 1.2 is a secure protocol version, the question asks for actions to take, and specifying TLS 1.2 is a subset of using HTTPS rather than a distinct required action. Option E is not marked correct because client-side encryption is an additional layer of protection, but it is not required by DynamoDB to achieve encryption at rest and in transit, as server-side encryption and HTTPS already satisfy those requirements.

Answer

Use TLS 1.2 for all connections.

Answer

Implement client-side encryption before writing items to DynamoDB.

Question 9

A developer is using IAM roles to grant permissions to an EC2 instance. Which TWO statements are true about IAM roles for EC2?

Accepted Answer

Temporary security credentials are obtained from the instance metadata service.. Option B is correct because an EC2 instance with an attached IAM role retrieves temporary security credentials (AccessKeyId, SecretAccessKey, and SessionToken) from the Instance Metadata Service at the link-local address 169.254.169.254 (IMDSv1) or via IMDSv2 with a PUT token request, and the AWS SDKs/CLI handle this retrieval automatically. Option E is correct because an IAM role can be attached to, replaced on, or detached from an existing EC2 instance through the console, AWS CLI (associate-iam-instance-profile / replace-iam-instance-profile-association), or API while the instance is running, with no stop/start required. Option A is false because an EC2 instance can have only one IAM instance profile (and thus one role) attached at a time. Option C is false because the temporary credentials are automatically rotated by the instance metadata service well before expiration (typically every few hours, with a default of 6 hours but auto-refreshed), so no manual refresh is needed. Option D is false because a single IAM role can be assumed by many EC2 instances simultaneously via the same instance profile.

Answer

An EC2 instance can have multiple IAM roles attached simultaneously.

Answer

The temporary credentials expire after 6 hours and must be manually refreshed.

Answer

An IAM role can only be attached to one EC2 instance at a time.

Question 10

A company runs a web application on EC2 instances in an Auto Scaling group. The application uses an IAM role to access an S3 bucket that stores user uploads. Recently, the security team discovered that some uploaded files contain malicious content. The team wants to implement a solution that automatically scans new objects for malware and blocks access if threats are detected. The solution must be cost-effective and minimize latency for legitimate uploads. The developer is tasked with designing this solution. Which approach should the developer take?

Accepted Answer

Enable Amazon GuardDuty with S3 protection, configure an S3 event notification to trigger a Lambda function that scans new objects using a third-party malware engine, and update the bucket policy to deny access to objects that fail the scan.. Using Amazon GuardDuty with S3 protection and an S3 Event Notification to trigger a Lambda function for scanning provides automated threat detection and response. Option A is wrong because S3 Batch Operations is for large-scale batch jobs, not real-time scanning. Option B is wrong because S3 Object Lambda is for modifying objects, not scanning. Option C is wrong because Macie is for sensitive data discovery, not malware.

Answer

Use S3 Batch Operations to run a scanning script on all existing objects and then schedule periodic scans.

Answer

Use S3 Object Lambda to transform objects upon retrieval and check for malware.

Answer

Enable Amazon Macie on the S3 bucket to automatically detect malicious content.

Question 11

A developer is building a mobile application that uses Amazon Cognito User Pools for authentication. The app needs to access a REST API hosted on AWS. The developer wants to use Cognito to authorize API requests. The API Gateway is configured with a Cognito User Pool authorizer. However, when testing, the API returns a 401 Unauthorized error even though the user is authenticated. The developer verified that the user exists in the user pool and the ID token is valid. What is the MOST likely cause and solution?

Accepted Answer

The API request is missing the Authorization header with the token. The developer should add the token to the Authorization header.. API Gateway with a Cognito User Pool authorizer expects the JWT to be presented in the Authorization HTTP header, typically as 'Bearer <token>'. A 401 Unauthorized with a valid token almost always means the header is missing, malformed, or the token is being sent in a query string or custom header instead. The fix is to attach the token to the Authorization header on every request.

Answer

The API Gateway authorizer is not properly configured. The developer should delete and recreate the authorizer.

Answer

The developer is using the wrong token. The API Gateway authorizer requires the access token, not the ID token.

Answer

The API Gateway method request header is not mapped. The developer should add a mapping template to pass the token.

Question 12

A company has an S3 bucket that contains sensitive financial data. The security team requires that all access to the bucket be logged for audit purposes. The developer needs to enable logging that captures who accessed the bucket, the actions performed, and the source IP addresses. The logs must be stored in a separate bucket for security. Which solution meets these requirements?

Accepted Answer

Enable AWS CloudTrail with S3 data events and deliver logs to a separate S3 bucket.. AWS CloudTrail with S3 data events captures object-level API activity (GetObject, PutObject, DeleteObject) for the bucket, recording the identity of the caller, the action performed, the source IP address, and the timestamp. CloudTrail can be configured to deliver these logs to a separate S3 bucket, satisfying the requirement to store logs separately for security. This provides the detailed audit trail needed for sensitive financial data.

Answer

Use Amazon CloudWatch Logs to capture S3 access logs by enabling S3 data events in CloudWatch.

Answer

Enable S3 server access logging on the bucket and store logs in the same bucket.

Answer

Enable VPC Flow Logs on the VPC that contains the S3 bucket.

Question 13

A company stores sensitive data in an S3 bucket that must be encrypted at rest. The security team requires that all objects uploaded to the bucket are automatically encrypted using server-side encryption with AWS KMS (SSE-KMS). A developer uploads an object without specifying any encryption header. The upload succeeds, but the object is not encrypted. What is the most likely cause?

Accepted Answer

The bucket does not have a default encryption configuration set to SSE-KMS.. S3 buckets do not automatically encrypt objects unless default encryption is configured. Without a default encryption setting, objects uploaded without encryption headers are stored unencrypted. Option A is incorrect because even if a bucket policy denies uploads without encryption headers, the upload would fail, not succeed unencrypted. Option B is incorrect because if the KMS key policy denied encryption, the upload would fail, not succeed unencrypted. Option C is incorrect because while default encryption can be disabled, the key point is that no default encryption configuration exists, and specifically not SSE-KMS. The question asks for the most likely cause, which is that the bucket lacks a default encryption configuration for SSE-KMS.

Answer

The bucket policy denies uploads without the x-amz-server-side-encryption header, but the developer's IAM user has permission to override the bucket policy.

Answer

The KMS key policy does not allow the IAM user to encrypt with that key.

Answer

The S3 bucket has default encryption disabled.

Question 14

A developer is configuring cross-account access to an S3 bucket. The bucket in Account A has a bucket policy granting access to an IAM role in Account B. The IAM role's trust policy allows the developer's IAM user in Account B to assume the role. When the developer tries to access the bucket from Account B using the assumed role, they receive an Access Denied error. Which additional step is required to resolve this?

Accepted Answer

Ensure the bucket policy grants the necessary permissions to the IAM role ARN from Account B.. Ensure the bucket policy grants the necessary permissions to the IAM role ARN from Account B. The developer is able to assume the IAM role in Account B, but the role itself does not have access to the S3 bucket because the bucket policy in Account A does not explicitly grant permissions to the role ARN. The bucket policy must include a statement allowing the role (e.g., arn:aws:iam::AccountB:role/RoleName) to perform the required actions on the bucket. Option A is incorrect because adding the developer's IAM user ARN to the bucket policy is unnecessary; the access is via the assumed role. Option B is incorrect because a VPC endpoint is not required for cross-account S3 access. Option D is incorrect because it bypasses the cross-account role setup and is less secure.

Answer

Add the developer's IAM user ARN to the bucket policy in Account A.

Answer

Configure a VPC endpoint for S3 in Account A and attach it to the bucket policy.

Answer

Create an IAM user in Account A and grant it S3 access, then share the credentials with the developer.

Question 15

Refer to the exhibit. An IAM policy attached to a user includes the above statement. The user uploads an object to the S3 bucket without specifying any encryption header. What is the outcome?

Accepted Answer

The upload fails with an Access Denied error.. The upload fails with an Access Denied error. The IAM policy statement includes a condition such as s3:x-amz-server-side-encryption requiring a specific encryption header, so when the user uploads without specifying any encryption header, the condition is not satisfied and the request is denied. Because the policy explicitly enforces server-side encryption via the request header, S3 does not silently apply a default encryption on the user's behalf for this authorization check. Options A, B, and C are incorrect because they all assume the upload succeeds, which contradicts the policy's enforced encryption condition; no SSE-KMS, SSE-S3, or unencrypted object is created when the request is denied.

Answer

The upload succeeds and the object is encrypted with SSE-KMS.

Answer

The upload succeeds and the object is not encrypted.

Answer

The upload succeeds and the object is encrypted with SSE-S3.