DVA-C02 Security Practice Test 6 — 15 Questions

Question 1

A company has a VPC with public and private subnets. The private subnets contain Amazon RDS databases. Which TWO actions are required to secure the database instances?

Accepted Answer

Configure security groups to allow only necessary traffic from application servers.. The two required actions to secure RDS instances in a VPC are: (A) Configure security groups to allow only necessary traffic from application servers, and (E) Place the RDS instances in private subnets. Security groups act as a virtual firewall, controlling inbound traffic at the instance level. By restricting access to only the application servers on the required database port (e.g., 3306 for MySQL), you minimize exposure. Placing RDS in private subnets ensures the instances have no direct route to the internet, as private subnets do not have an internet gateway route. This prevents direct internet access to the databases.

Option B is incorrect because IAM roles attached to RDS control permissions for AWS service integration, not network access. Database authentication is managed via database credentials or IAM database authentication, not by an IAM role on the instance. Option C is incorrect because network ACLs are stateless and applied at the subnet level; allowing inbound traffic on port 3306 from anywhere is overly permissive and insecure. The primary security mechanism should be security groups. Option D is incorrect because placing RDS in public subnets would expose the databases to the internet, defeating the purpose of security. Private subnets are essential for database security.

Answer

Attach an IAM role to the RDS instance to control access.

Answer

Use network ACLs to allow inbound traffic on port 3306 from anywhere.

Answer

Place the RDS instances in public subnets with a route to an internet gateway.

Question 2

A developer is designing a serverless application using AWS Lambda, Amazon API Gateway, and Amazon DynamoDB. The application requires that only authenticated users can invoke the API, and the data must be encrypted at rest. Which THREE steps should the developer take?

Accepted Answer

Enable CloudWatch Logs for API Gateway to log all requests.. Enabling CloudWatch Logs for API Gateway allows logging of all requests, which is essential for auditing and monitoring access, helping to meet security requirements. Option C is correct because DynamoDB encryption at rest is enabled by default using an AWS-owned CMK, ensuring data is encrypted. Option D is correct because implementing a Lambda authorizer in API Gateway can validate a JWT token, ensuring only authenticated users can invoke the API. Option B is wrong: while you can use a customer managed KMS key, it is not required; the default encryption is sufficient and the question does not mandate customer managed keys. Option E is wrong: IAM authorization is suitable for IAM users/roles, but not for end-user authentication with tokens like JWT; a Lambda authorizer is the appropriate solution.

Answer

Create a customer managed KMS key and use it to encrypt DynamoDB tables.

Answer

Use IAM authorization on the API Gateway methods.

Question 3

A developer is using AWS KMS to encrypt data. Which TWO are valid operations that can be performed using KMS?

Accepted Answer

Generate data keys for envelope encryption.. Option B is correct because AWS KMS provides the GenerateDataKey API, which returns a plaintext data key plus an encrypted copy of that key, enabling envelope encryption where the data key encrypts the actual data and the CMK protects the data key. Option D is correct because KMS supports direct encryption of small payloads (up to 4 KB) via the Encrypt API using a customer master key (CMK), returning ciphertext that can later be decrypted with Decrypt. Option A is incorrect because KMS stores keys in AWS-managed HSMs under FIPS 140-2 validated hardware, not on an HSM in the customer's own data center; that scenario describes AWS CloudHSM or custom key store setups, not a standard KMS operation. Option C is incorrect because KMS does not perform keyed hashing (HMAC) operations; that would require a service like AWS Secrets Manager or a custom implementation. Option E is incorrect because KMS does not issue SSL/TLS certificates; that is handled by AWS Certificate Manager (ACM).

Answer

Store customer-managed keys on an HSM in your data center.

Answer

Hash data using a keyed hash function.

Answer

Generate SSL/TLS certificates for a domain.

Question 4

A developer is deploying an application on EC2 that must access an S3 bucket and an SQS queue. The developer wants to follow the principle of least privilege. Which THREE steps should be taken?

Accepted Answer

Create an IAM role with permissions to access S3 and SQS.. To follow least privilege, create an IAM role with a permissions policy that grants only the necessary S3 and SQS actions on the specific resources, then attach the role to the EC2 instance via an instance profile. Resource-based policies (bucket policy, queue policy) are not needed for the role to access resources in the same account; identity-based policies on the role suffice. Adding B and D is redundant and not a required step. The correct minimal steps are C and attaching the role to the instance (which is not an option), so the question is flawed.

Answer

Attach the IAM role directly to the EC2 instance as a security group.

Answer

Configure an SQS queue policy that grants access to the IAM role.

Answer

Configure an S3 bucket policy that grants access to the IAM role.

Answer

Attach an IAM policy directly to the EC2 instance.

Question 5

A company uses AWS Organizations with multiple accounts. The security team wants to enforce that all S3 buckets across all accounts have server-side encryption enabled. They have created an SCP that denies the s3:PutBucketAcl action unless the request includes the x-amz-server-side-encryption header. However, some application teams report that they cannot create buckets even when they include the required header. What is the MOST likely cause of this issue?

Accepted Answer

The SCP is incorrectly targeting s3:PutBucketAcl instead of s3:CreateBucket.. The SCP denies s3:PutBucketAcl, not s3:CreateBucket. The SCP should deny s3:CreateBucket unless the encryption header is present. Option B is wrong because even if the SCP is not applied to the root OU, but only to specific accounts, it would still apply to those accounts; the issue is the action being denied, not the scope. Option C is wrong because if the condition key were misspelled, the condition would simply not be evaluated, and the deny would still block bucket creation despite the header being present. Option D is wrong because SCPs are evaluated before resource-based policies; if the SCP denies the action, the request fails regardless of any resource-based policy that might allow it.

Answer

The SCP is not applied to the root OU, only to specific accounts.

Answer

The condition key in the SCP is misspelled.

Answer

The SCP is being overridden by a resource-based policy on the S3 bucket.

Question 6

A company stores sensitive data in an S3 bucket that must be encrypted at rest. The security team requires that the encryption keys be rotated every 90 days and that access to the keys be auditable. Which solution meets these requirements with the LEAST operational overhead?

Accepted Answer

Use SSE-KMS with a customer managed key and enable automatic key rotation.. SSE-KMS with a customer managed key (CMK) satisfies all three requirements: encryption at rest, automatic key rotation (configurable to 90 days via the KMS console/API), and auditable key usage through CloudTrail logging of every KMS Decrypt/Encrypt call. AWS-managed keys (aws/s3) rotate automatically every year and cannot be audited per-key or scheduled to 90 days, so a CMK is required. This is the least-overhead option because AWS handles the encryption/decryption transparently.

Answer

Use SSE-S3 with default encryption enabled.

Answer

Use client-side encryption with the AWS Encryption SDK.

Answer

Use SSE-C with keys stored in AWS Secrets Manager.

Question 7

A company uses AWS Secrets Manager to rotate database credentials. The rotation process uses a Lambda function that updates the secret. The developer notices that the rotation sometimes fails because the Lambda function does not have permission to update the secret. What is the MOST likely cause?

Accepted Answer

The Lambda function's execution role does not have the necessary IAM permissions to update the secret.. The Lambda function's execution role must have IAM permissions to update the secret (e.g., secretsmanager:PutSecretValue). Without these permissions, the rotation will fail. Option A is incorrect because resource-based policies on secrets are not commonly denied to Lambda functions; the primary issue is the execution role. Option C is incorrect because KMS permissions are needed to decrypt the secret, but the update action itself requires IAM permissions on the secret. Option D is incorrect because VPC configuration does not affect IAM permissions; the Lambda can call Secrets Manager over the internet or via a VPC endpoint, but that is not the cause of permission failure.

Answer

The secret has a resource-based policy that denies the Lambda function.

Answer

The KMS key used to encrypt the secret is not accessible by the Lambda function.

Answer

The Lambda function is not in the same VPC as the Secrets Manager endpoint.

Question 8

A developer is designing a system that uses AWS KMS to encrypt data. Which of the following are valid ways to grant a user permission to decrypt data using a KMS key? (Select TWO.)

Accepted Answer

Use a resource-based policy on the KMS key that grants access to the user.. Options A and C are correct. A resource-based policy (key policy) on a KMS key can directly grant decrypt permission to a user (A). Additionally, you can attach an IAM policy to the user granting kms:Decrypt, provided the key policy allows access from the user's account (C). Option B is incorrect because KMS grants are intended for cross-account or temporary access, not as a primary method for granting user permissions within the same account. Option D is incorrect because S3 bucket policies cannot grant kms:Decrypt. Option E is incorrect because it grants permission to an IAM role, not directly to a user, and the question asks about granting a user permission.

Answer

Create a KMS grant that allows the user to decrypt the key.

Answer

Add a statement in the S3 bucket policy that allows kms:Decrypt for the user.

Answer

Add a statement in the key policy that allows the IAM role to perform kms:Decrypt.

Question 9

A company hosts a web application on EC2 instances behind an Application Load Balancer. The application stores sensitive user data in an S3 bucket. A security audit reveals that the S3 bucket policy allows access from any AWS account. Which combination of actions should be taken to secure the bucket?

Accepted Answer

Modify the bucket policy to allow access only from the application's VPC endpoint or specific IAM roles. The question stem should be updated to ask for a single action instead of a combination of actions, as only Option C is correct.

Answer

Enable default encryption on the bucket

Answer

Enable S3 Block Public Access at the account level

Answer

Enable AWS CloudTrail to log bucket access

Question 10

A company wants to audit all API calls made in their AWS account for security analysis. Which TWO services should be used together to achieve this?

Accepted Answer

Amazon S3. AWS CloudTrail (D) is correct because it records every API call made in the AWS account as management and data events, capturing who made the request, when, from which IP, and which resources were affected — exactly the audit trail needed for security analysis. Amazon S3 (A) is correct because CloudTrail delivers its event logs as JSON objects to an S3 bucket, which serves as the durable, queryable storage layer for long-term audit retention and downstream analysis (e.g., with Athena or a SIEM). Together, CloudTrail captures the API activity and S3 stores the resulting log files, satisfying the requirement to audit all API calls. Amazon GuardDuty (B) is a threat-detection service that analyzes logs (including CloudTrail events) but does not itself record API calls, so it cannot serve as the audit source. AWS Config (C) tracks resource configuration changes and compliance, not the full set of API calls, and Amazon CloudWatch Logs (E) is a general log aggregation/monitoring service that is not the native destination for CloudTrail API audit records.

Answer

Amazon GuardDuty

Answer

AWS Config

Answer

Amazon CloudWatch Logs

Question 11

A company runs a containerized application on Amazon ECS using Fargate. The application needs to access an S3 bucket to read configuration files and a DynamoDB table to store session state. The ECS task role is configured with the following IAM policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "dynamodb:PutItem",
        "dynamodb:GetItem"
      ],
      "Resource": "*"
    }
  ]
}

The application fails to read from the S3 bucket and write to DynamoDB. The error messages indicate AccessDenied. The S3 bucket has a bucket policy that denies all access unless the request includes a specific aws:SourceIp condition. The DynamoDB table has a resource-based policy that allows access only from the VPC endpoint. The ECS tasks are running in a private subnet with a VPC endpoint for DynamoDB but no VPC endpoint for S3. Which action should be taken to resolve the errors?

Accepted Answer

Create a VPC endpoint for S3 and modify the S3 bucket policy to allow access from the VPC endpoint. The application fails to read from S3 because there is no VPC endpoint for S3, and the bucket policy denies access unless a specific IP condition is met. Since a VPC endpoint for DynamoDB already exists and the table policy allows access from it, DynamoDB access succeeds. To resolve the S3 AccessDenied error, a VPC endpoint for S3 must be created, and the S3 bucket policy must be updated to allow access from this VPC endpoint.

Answer

Add s3:ListBucket to the task role policy and ensure the S3 bucket policy allows the task role ARN

Answer

Attach a NAT gateway to the private subnet and update the S3 bucket policy to allow the NAT gateway's public IP

Answer

Modify the task role policy to restrict resource ARNs to the specific S3 bucket and DynamoDB table

Question 12

A company uses AWS IAM roles to grant permissions to EC2 instances. An application running on an instance fails to access an S3 bucket. The IAM role has the following policy attached: {"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:GetObject","Resource":"arn:aws:s3:::my-bucket/*"}]}. What is the likely cause?

Accepted Answer

The trust policy of the role does not allow EC2 to assume it.. For an EC2 instance to successfully use an IAM role, the role must have a trust policy (trust relationship) that allows the Amazon EC2 service principal ('ec2.amazonaws.com') to perform the 'sts:AssumeRole' action. If this trust policy is missing or misconfigured, the EC2 instance cannot retrieve temporary credentials from the Instance Metadata Service (IMDS), causing all AWS API calls from the application to fail with an access or credential error, despite the attached IAM policy having the correct S3 permissions.

Answer

The instance does not have an instance profile.

Answer

The policy does not include s3:ListBucket permission.

Answer

The IAM role is not attached to the EC2 instance.

Question 13

A company has an S3 bucket that contains sensitive data. The security team requires that all objects uploaded to the bucket must be encrypted at rest using AWS KMS. Which combination of actions will enforce this?

Accepted Answer

Use a bucket policy that denies PutObject if the x-amz-server-side-encryption header is not 'aws:kms'.. A bucket policy that denies PutObject requests when the `x-amz-server-side-encryption` header is not set to `aws:kms` enforces encryption at rest using AWS KMS for all uploads. This policy explicitly rejects any upload that does not include the required KMS encryption header, ensuring compliance with the security team's requirement. Default encryption settings (like SSE-S3 or SSE-KMS) can be overridden by the client, so a bucket policy is the only way to enforce encryption at the API level.

Answer

Configure the bucket to use SSE-S3 by default.

Answer

Enable default encryption on the bucket with SSE-KMS.

Answer

Use a bucket policy that allows only PutObject with KMS encryption.

Question 14

A developer is configuring a Lambda function to access a DynamoDB table in a VPC. Which TWO steps are required to ensure the Lambda function can securely access DynamoDB? (Select TWO.)

Accepted Answer

Attach the Lambda function to a VPC.. Option B is correct because a Lambda function must be explicitly attached to the VPC (specifying subnets and a security group) before it can use VPC networking to reach resources like DynamoDB; by default Lambda runs outside your VPC. Option C is correct because a DynamoDB gateway VPC endpoint lets the Lambda function reach DynamoDB privately over the AWS network without traversing the internet, NAT, or an internet gateway, which is the secure access pattern for VPC-attached Lambda. Option A is not required because a NAT gateway only provides outbound internet access and is unnecessary when a DynamoDB VPC endpoint is used. Option D is not a separate required step because the gateway endpoint's route is automatically added to the subnet route table when the endpoint is created. Option E is not required as a distinct step because Lambda automatically assigns the specified security group to the function's ENIs, and the default outbound rule already permits the traffic; the security group is configured as part of attaching the function to the VPC, not as an additional required action.

Answer

Configure a NAT gateway in the VPC.

Answer

Add a route to the DynamoDB service in the subnet's route table.

Answer

Assign a security group to the Lambda function that allows outbound traffic to DynamoDB.

Question 15

Based on the CloudTrail log entry, which security concern should be investigated?

Accepted Answer

Multi-factor authentication (MFA) was not used when assuming the role.. The stem asks the candidate to analyze a CloudTrail log entry, but the actual JSON or text of the log entry is missing from the question. Please provide the CloudTrail log entry in the stem so that candidates can evaluate the MFA status, source IP, region, or permissions.

Answer

The role used has too many permissions.

Answer

The instance was launched in an unauthorized region.

Answer

The source IP address is from a suspicious location.