DVA-C02 Security Practice Test 5 — 15 Questions

Question 1

A developer is designing a microservices architecture where each service communicates over HTTPS. They need to ensure that only authorized services can invoke each other. Which TWO services can be used to manage authentication and authorization between services?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

AWS App Mesh. The correct answers are AWS App Mesh and AWS VPC Lattice. App Mesh provides mutual TLS (mTLS) for service-to-service authentication, while VPC Lattice includes IAM-based authentication and authorization for service-to-service traffic. Amazon API Gateway is typically used for external API access and can enforce auth, but it is not primarily a service-to-service communication/auth service. AWS Resource Access Manager is for sharing resources across accounts, and AWS Direct Connect is a network connection service, neither provides service authentication.

Answer

AWS Resource Access Manager

Answer

AWS Direct Connect

Answer

Amazon API Gateway

Question 2

A company wants to ensure that only encrypted connections are used to access their S3 bucket. Which THREE methods can be used to enforce this?

Accepted Answer

Use Amazon CloudFront with the S3 bucket as origin and require HTTPS.. To enforce encrypted connections to S3, you can use a bucket policy denying aws:SecureTransport=false (D) or configure CloudFront with HTTPS and restrict S3 access to CloudFront (A). Option E encrypts objects but does not require TLS for the connection itself. Options B and C are unrelated to encryption in transit.

Answer

Enable default encryption on the bucket.

Answer

Enable S3 Block Public Access on the bucket.

Answer

Use client-side encryption for all uploads.

Question 3

Refer to the exhibit. An IAM policy is attached to a user. The user reports that they can access objects in the S3 bucket from their office IP address (192.0.2.15) but cannot access from home (203.0.113.5). What is the most likely reason?

Accepted Answer

The policy restricts access based on source IP address.. The policy includes a condition that restricts the source IP address to the 192.0.2.0/24 range. The user can access from the office (192.0.2.15) which is within that range, but cannot access from home (203.0.113.5) which is outside. Therefore, option C is correct. Option A is incorrect because the condition is based on IP address, not VPC. Option B is incorrect because the bucket policy itself is not the issue; the IAM user policy is what's restricting. Option D is incorrect because the policy does not deny all s3:GetObject; it allows it for the specified IP range.

Answer

The policy requires requests to originate from a VPC.

Answer

The bucket policy does not allow the user.

Answer

The policy denies all s3:GetObject actions.

Question 4

Refer to the exhibit. An IAM role has the attached policy. A developer is writing an application that will upload objects to the S3 bucket using server-side encryption with AWS KMS (SSE-KMS). The application is failing with an Access Denied error when trying to upload. What is the missing permission?

Accepted Answer

kms:Decrypt on the KMS key. The missing permission is kms:Decrypt on the KMS key. Although SSE-KMS requires kms:GenerateDataKey for encryption during upload, certain scenarios (e.g., when the KMS key has already been used in the same region or when the bucket policy includes conditional checks) may require kms:Decrypt to verify key access. The current policy allows kms:GenerateDataKey but lacks kms:Decrypt, causing Access Denied errors for the upload. Option A is correct. Option B (kms:ListKeys) is not required. Option C (kms:Encrypt) is not used by S3 for SSE-KMS. Option D (s3:PutObjectAcl) is not needed for basic uploads.

Answer

kms:ListKeys on the KMS key

Answer

kms:Encrypt on the KMS key

Answer

s3:PutObjectAcl on the bucket

Question 5

Refer to the exhibit. A developer is trying to query a DynamoDB table from a Lambda function that uses an execution role named MyRole. The Lambda function is failing with the error shown. Which step should the developer take to resolve this?

Accepted Answer

Attach a policy to the Lambda execution role that allows dynamodb:Query on the table.. The error indicates that the Lambda execution role MyRole lacks the dynamodb:Query permission on the DynamoDB table. Option C is correct: attach a policy to the Lambda execution role that allows dynamodb:Query on the table. Option A is incorrect because the error is about permissions, not encryption. Option B is incorrect because resource-based policies are used to grant cross-account access, not to grant permissions to a role within the same account. Option D is incorrect because the error is not related to KMS keys.

Answer

Enable DynamoDB encryption at rest.

Answer

Add a resource-based policy to the DynamoDB table allowing the Lambda role.

Answer

Grant the Lambda role kms:Decrypt permission on the KMS key.

Question 6

A developer is creating an IAM policy to allow an EC2 instance to access an S3 bucket. Which AWS service should the developer use to securely provide credentials to the EC2 instance?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. IAM roles are designed to be assumed by AWS services like EC2. Instance profiles deliver temporary credentials to the EC2 instance automatically, avoiding hard-coded keys. Option A is incorrect because Cognito identity pools are intended for user identity in mobile/web apps, not for EC2 instances. Option B is incorrect because storing IAM user access keys on the instance is insecure and not recommended. Option D is incorrect because AWS Secrets Manager is for managing secrets such as database credentials, not for providing credentials to EC2 instances. Option C is the correct approach: create an IAM role with the necessary S3 permissions and attach it to the EC2 instance profile.

Answer

Use Amazon Cognito identity pools to generate temporary credentials for the instance.

Answer

Create an IAM user with access keys and store them on the instance.

Answer

Store the AWS access key in AWS Secrets Manager and retrieve it at runtime.

Question 7

A company uses AWS KMS to encrypt data at rest in S3. The security team wants to audit all use of the KMS key, including decryption operations. What should the developer enable?

Accepted Answer

Enable AWS CloudTrail with data events for the KMS key.. AWS CloudTrail logs all KMS API calls, including Decrypt, Encrypt, and GenerateDataKey. This provides the audit trail required. Option A is wrong because S3 server access logs do not include KMS operation details. Option C is wrong because CloudWatch Logs is for log storage, not for capturing API calls. Option D is wrong because AWS Config records resource configuration changes, not API calls.

Answer

Enable AWS Config rules to monitor key usage.

Answer

Enable S3 server access logging.

Answer

Create a CloudWatch Logs log group and stream KMS logs.

Question 8

A developer is building a serverless application with AWS Lambda that needs to read from an Amazon DynamoDB table. The Lambda function is in a VPC. What is the MOST secure way to grant the Lambda function access to DynamoDB?

Accepted Answer

Attach an IAM role to the Lambda function that allows the necessary DynamoDB actions.. The most secure way to grant a Lambda function access to DynamoDB is by attaching an IAM role with a policy that allows only the necessary actions. IAM roles are the standard mechanism for granting permissions to AWS services. Option B (VPC endpoint) provides private network connectivity but does not grant access permissions; it still requires an IAM role. Option C (Secrets Manager) is unnecessary because DynamoDB uses IAM for authentication, not credentials. Option D (EC2 instance profile) is not applicable to Lambda functions.

Answer

Create a VPC endpoint for DynamoDB and associate a security group.

Answer

Store DynamoDB credentials in AWS Secrets Manager and retrieve them in the Lambda code.

Answer

Use an EC2 instance profile attached to the Lambda function's execution environment.

Question 9

A developer needs to allow an IAM user to temporarily access an AWS account for 12 hours. The developer must not create long-term credentials. What should the developer use?

Accepted Answer

Use AWS STS to generate temporary security credentials for a role.. IAM Security Token Service (STS) can generate temporary credentials with a custom expiration. By creating a role and allowing the user to assume it with a session duration of 12 hours, the requirement is met. Option A is wrong because IAM users have long-term credentials. Option C is wrong because resource-based policies alone don't grant cross-account access with temporary credentials. Option D is wrong because Cognito is for end users.

Answer

Create an IAM user with a password and access keys.

Answer

Attach a resource-based policy to the account.

Answer

Use Amazon Cognito user pools to generate temporary access.

Question 10

A company is using AWS CodePipeline to deploy a web application. The pipeline must securely store and use database credentials. Which AWS service should the developer use to store the credentials and retrieve them during deployment?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is the best choice for securely storing database credentials because it is designed for secrets management, supports automatic rotation, and integrates with AWS CodePipeline via Lambda functions or directly with some actions. Option A (IAM role attached to the CodePipeline service role) cannot store secrets; IAM roles provide permissions but not a storage mechanism for credentials. Option C (AWS Systems Manager Parameter Store with a SecureString parameter) can store secrets but lacks native rotation for RDS databases, making it less suitable. Option D (Amazon DynamoDB with server-side encryption) is a NoSQL database, not a secrets store, and would require additional custom logic to manage secrets securely.

Answer

IAM role attached to the CodePipeline service role.

Answer

AWS Systems Manager Parameter Store with a SecureString parameter.

Answer

Amazon DynamoDB with server-side encryption.

Question 11

A developer is deploying an application on EC2 that must access an S3 bucket. The developer wants to avoid hard-coding credentials. What is the MOST secure way to grant access?

Accepted Answer

Create an IAM role and attach it to the EC2 instance profile.. The most secure method is to create an IAM role with the necessary S3 permissions and attach it to the EC2 instance profile. The instance then obtains temporary credentials automatically from the EC2 metadata service, avoiding long-term credentials. Option A is incorrect because a bucket policy allowing access from a public IP is insecure and does not provide least privilege. Option B is correct and is the recommended approach. Option C is insecure because environment variables can be exposed to other processes. Option D is insecure because storing keys in a configuration file on the instance risks credential leakage if the instance is compromised.

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP address.

Answer

Set the AWS credentials as environment variables in the user data script.

Answer

Store the AWS access key ID and secret access key in a configuration file on the instance.

Question 12

A developer needs to encrypt data in an S3 bucket. The company requires that the encryption key be managed by AWS but with the ability to audit key usage. Which S3 encryption option should the developer use?

Accepted Answer

Server-Side Encryption with AWS KMS (SSE-KMS).. SSE-KMS uses AWS KMS to manage the encryption key and provides CloudTrail logs for auditing key usage, meeting the requirement for AWS-managed keys with auditability. SSE-S3 uses S3-managed keys but does not provide separate audit logs for key usage. SSE-C requires the customer to provide their own keys, not AWS-managed. Client-side encryption occurs before data is sent to S3 and does not use S3's server-side encryption. Therefore, SSE-KMS (option A) is the correct choice.

Answer

Client-side encryption.

Answer

Server-Side Encryption with S3-Managed Keys (SSE-S3).

Answer

Server-Side Encryption with Customer-Provided Keys (SSE-C).

Question 13

A developer is using Amazon API Gateway with a Lambda authorizer to secure a REST API. The developer wants to pass user context from the authorizer to the backend Lambda function. How should the developer accomplish this?

Accepted Answer

Return a context object from the Lambda authorizer that maps to integration request parameters.. The Lambda authorizer can return a context object alongside the IAM policy. This context object can be mapped to integration request parameters (such as headers or path parameters) using API Gateway's mapping templates or passthrough behavior. The backend function then receives the user context via those parameters. Option D is correct because returning a context object from the authorizer and mapping it to integration request parameters is the standard method. Option A is incorrect because the principal identifier is a single field, not suitable for passing multiple context values. Option B is incorrect because the authorization token is the input to the authorizer, not the output. Option C is incorrect because custom headers are not automatically mapped to resource path parameters; such a mapping would not pass user context from the authorizer.

Answer

Include the user context in the principal identifier returned by the authorizer.

Answer

Encode the user context in the authorization token.

Answer

Use a custom header that maps to a resource path parameter.

Question 14

A company has a multi-account architecture using AWS Organizations. The security team wants to centrally manage IAM policies that apply to all accounts. Which AWS feature should the developer use?

Accepted Answer

Service control policies (SCPs) in AWS Organizations.. Service control policies (SCPs) in AWS Organizations allow the security team to centrally set permission guardrails across all accounts in the organization. SCPs define the maximum permissions for IAM users and roles in member accounts, enabling centralized management. Option B, IAM cross-account roles, provides temporary access but is managed per account. Option C, AWS Config conformance packs, ensures compliance rules but does not manage permissions. Option D, attaching IAM policies to the root user, is not a best practice for central management.

Answer

IAM cross-account roles.

Answer

AWS Config conformance packs.

Answer

IAM policies attached to the root user.

Question 15

A developer is implementing a solution to encrypt data in transit for a web application running on an Application Load Balancer (ALB). Which TWO actions should the developer take?

Accepted Answer

Configure the ALB listener to use HTTPS protocol.. To encrypt data in transit between clients and the ALB, you need to configure the ALB listener to use HTTPS (B) and install an SSL/TLS certificate on the ALB (E). Option A (client-side encryption) encrypts data within the application, not at the ALB level. Option C (S3 server-side encryption) protects data at rest, not in transit. Option D (security group rule) restricts traffic but does not provide encryption.

Answer

Use client-side encryption in the application code.

Answer

Enable S3 server-side encryption for application logs.

Answer

Add a security group rule to allow only HTTPS traffic.