DVA-C02 Security Practice Test 5 — 15 Questions

Question 1

A developer needs to grant cross-account access to an S3 bucket for an IAM user from another AWS account. The developer has added a bucket policy that allows the user's ARN. However, the user still cannot access the bucket. What additional step is required?

Accepted Answer

The user must have an IAM policy allowing the required S3 actions on that bucket. A is correct because cross-account access to an S3 bucket requires both a resource-based policy (the bucket policy) that grants access to the user's ARN and an identity-based policy (an IAM policy attached to the user) that explicitly allows the required S3 actions on that bucket. Without the IAM policy, the user's account denies the request by default, even if the bucket policy permits it. This is the principle of 'permission delegation' in AWS: the resource owner can grant access, but the user's own account must also authorize the action.

Answer

The bucket must be made public

Answer

The user must use a different AWS CLI profile

Answer

The resource-based policy must explicitly allow the user's ARN

Question 2

A company wants to enforce that all IAM users use multi-factor authentication (MFA) when accessing the AWS Management Console. Which IAM policy condition key should be used in a policy attached to each user or group to deny access if MFA is not present?

Accepted Answer

aws:MultiFactorAuthPresent. The correct condition key is `aws:MultiAuthFactorPresent`, which is a boolean value that is `true` when the user has authenticated using a valid MFA device. By using this key in a `Deny` effect policy (often combined with `Bool` condition), you can block any API call or console access that does not include MFA authentication. This is the standard AWS approach to enforce MFA for console access.

Answer

aws:RequestedRegion

Answer

aws:SourceIp

Answer

aws:SecureTransport

Question 3

A developer is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application needs to encrypt data in transit between the client and the ALB. Which AWS service should be used to manage the SSL/TLS certificate?

Accepted Answer

AWS Certificate Manager (ACM). AWS Certificate Manager (ACM) is the correct service because it provisions, manages, and deploys public and private SSL/TLS certificates that can be associated with an Application Load Balancer (ALB) to encrypt data in transit between clients and the ALB. ACM handles certificate renewal automatically and integrates natively with ALB, removing the need for manual certificate management. This ensures HTTPS termination at the load balancer, securing the client-to-ALB communication.

Answer

AWS Key Management Service (KMS)

Answer

AWS Secrets Manager

Answer

AWS Identity and Access Management (IAM)

Question 4

A company stores sensitive customer data in Amazon S3. The security policy requires that all data be encrypted at rest using server-side encryption with a customer-managed AWS KMS key. Which S3 server-side encryption option should the developer use?

Accepted Answer

SSE-KMS. SSE-KMS is the correct option because it provides server-side encryption with a customer-managed AWS KMS key, allowing the company to control key rotation, access policies, and audit usage via AWS CloudTrail. This meets the security policy requirement for encryption at rest using a customer-managed key, which SSE-S3 (using AWS-managed keys) and SSE-C (using customer-provided keys) do not fulfill.

Answer

SSE-S3

Answer

SSE-C

Answer

Client-side encryption

Question 5

A developer needs to store a database password for an AWS Lambda function. The password must be encrypted at rest with a customer-managed key that can be rotated manually. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Store the password in an encrypted Lambda environment variable using a customer-managed AWS KMS key. Option A is correct because storing the password in an encrypted Lambda environment variable using a customer-managed AWS KMS key meets the encryption-at-rest requirement with minimal operational overhead. Lambda natively integrates with KMS to encrypt environment variables at rest using a customer-managed key, and the key can be manually rotated via the AWS Management Console or API. This approach requires no additional services or infrastructure, keeping operational overhead low.

Answer

Store the password in AWS Systems Manager Parameter Store as a SecureString parameter

Answer

Store the password in AWS Secrets Manager and configure automatic rotation

Answer

Store the password in an Amazon S3 configuration file encrypted with server-side encryption

Question 6

An API Gateway HTTP API should allow access only to users authenticated by an external OIDC provider. Which authorizer type is most appropriate?

Accepted Answer

JWT authorizer configured for the issuer and audience. Option C is correct because an HTTP API Gateway with an external OIDC provider requires a JWT authorizer. The JWT authorizer validates the token's signature, issuer, and audience against the OIDC provider's configuration, ensuring only authenticated users gain access. This is the native AWS mechanism for integrating third-party OIDC identity providers like Auth0 or Okta.

Answer

IAM authorizer

Answer

API key authorizer

Answer

S3 bucket policy

Question 7

A Lambda function needs to decrypt data encrypted with a customer managed KMS key. Which two permissions are commonly required?

Accepted Answer

kms:Decrypt on the key. Option A is correct because the Lambda function must have permission to call the kms:Decrypt action on the specific customer managed KMS key to decrypt the data. This permission is granted via a key policy or a grant on the KMS key itself, allowing the Lambda execution role to use the key for decryption operations.

Answer

iam:CreateUser on the account

Answer

s3:PutBucketAcl on every bucket

Question 8

A developer stores database credentials in Secrets Manager. The application sometimes receives AccessDeniedException from Lambda after secret rotation. What should be checked first?

Accepted Answer

Whether the Lambda execution role and KMS key policy allow access to the new secret version and key. The AccessDeniedException from Lambda after secret rotation indicates that the Lambda function cannot access the new secret version. This is most commonly caused by the Lambda execution role lacking the necessary permissions (e.g., secretsmanager:GetSecretValue) for the new secret version ARN, or the KMS key policy not granting the Lambda role access to decrypt the secret using the customer-managed KMS key. Checking these two policies first is the correct troubleshooting step because rotation creates a new version with a different ARN, and the IAM policy must allow access to all versions or use a wildcard.

Answer

Whether API Gateway caching is enabled

Answer

Whether the VPC has exactly three subnets

Answer

Whether CloudFront invalidation completed

Question 9

A mobile application must let authenticated users upload only to their own S3 prefix. Which approach best follows least privilege?

Accepted Answer

Use Cognito identity credentials with an IAM policy scoped to the user's prefix using policy variables. Option A is correct because it uses Amazon Cognito identity pools to issue temporary AWS credentials scoped to a specific S3 prefix via IAM policy variables (e.g., `${cognito-identity.amazonaws.com:sub}`). This ensures each authenticated user can only upload to their own prefix (e.g., `uploads/${user_id}/`), adhering to the principle of least privilege by granting no more access than necessary.

Answer

Use a single hardcoded access key in the app

Answer

Make the bucket public and validate names in the client

Answer

Give every user AmazonS3FullAccess

Question 10

An application receives webhooks from a partner. The developer must verify that each request was signed by the partner and not modified in transit. What should the application validate?

Accepted Answer

The HMAC or digital signature over the payload using the shared/public key material. Option C is correct because webhook verification relies on validating a cryptographic signature (HMAC or digital signature) computed over the request payload using a pre-shared secret or public key. This ensures the payload was signed by the partner and has not been tampered with during transit, as any modification would invalidate the signature. The application must recompute the HMAC or verify the digital signature using the partner's public key and compare it to the signature provided in the request header.

Answer

The source port number

Answer

The CloudWatch log stream name

Answer

The API Gateway request ID only

Question 11

A developer needs to call AWS APIs from application code running on EC2. Which credential source should the AWS SDK use by default?

Accepted Answer

Temporary credentials from the instance profile role. Option D is correct because the AWS SDK on EC2 automatically retrieves temporary credentials from the instance metadata service (IMDS) at http://169.254.169.254/latest/meta-data/iam/security-credentials/. These credentials are provided by the IAM role attached to the EC2 instance (the instance profile role) and are rotated automatically, eliminating the need to store long-term credentials on the instance.

Answer

Static credentials committed to Git

Answer

A credentials file copied into the AMI

Answer

The root account access key

Question 12

An S3 bucket policy allows GetObject from another account, but objects encrypted with SSE-KMS still return AccessDenied. Which additional authorization is required?

Accepted Answer

The caller must be allowed to use the KMS key for decrypt operations. When an S3 object is encrypted with SSE-KMS, the S3 bucket policy granting GetObject access is not sufficient because S3 must also decrypt the object before returning it. The AWS KMS key policy must grant the caller kms:Decrypt permission, and the caller's IAM policy must also allow kms:Decrypt on the specific KMS key. Without this additional KMS authorization, S3 returns AccessDenied even if the bucket policy allows GetObject.

Answer

The caller must own the destination VPC

Answer

The bucket must enable static website hosting

Answer

The object key must end with .kms

Question 13

A developer needs to prevent accidental public access to all S3 buckets in an account. Which account-level control should be enabled?

Accepted Answer

S3 Block Public Access. S3 Block Public Access is an account-level control that provides a centralized way to enforce that no S3 buckets or objects in the account can be made publicly accessible, regardless of individual bucket policies or ACLs. This setting overrides any bucket-level public access settings, effectively preventing accidental exposure of data to the internet.

Answer

S3 Transfer Acceleration

Answer

S3 Inventory

Answer

S3 Object Lambda

Question 14

A Lambda function in a VPC must retrieve secrets from Secrets Manager without traversing the public internet. Which configuration should be used?

Accepted Answer

An interface VPC endpoint for Secrets Manager with appropriate security groups. An interface VPC endpoint (AWS PrivateLink) for Secrets Manager allows Lambda functions within a VPC to securely retrieve secrets using private IP addresses, without traversing the public internet. This is achieved by creating an elastic network interface in the VPC subnet with a security group that controls access, ensuring traffic stays within the AWS network.

Answer

A public NAT gateway only

Answer

An internet gateway attached to the Lambda subnet

Answer

A VPC peering connection to every AWS region

Question 15

A developer uses API Gateway with Cognito. Which two token validations are important when authorizing API access?

Accepted Answer

Validate issuer and audience/client ID. Option A is correct because API Gateway with Cognito requires validating the JWT's issuer (iss) claim to ensure the token was issued by the expected Cognito user pool, and validating the audience (aud) or client ID (azp) claim to confirm the token was intended for the specific API Gateway application. Without these checks, an attacker could use a token from a different user pool or client to access the API.

Answer

Accept any JWT signed with none algorithm

Answer

Trust only the username string sent in a header