DVA-C02 Security Practice Test 6 — 15 Questions

Question 1

A developer is designing a CI/CD pipeline using AWS CodePipeline. The pipeline must deploy to multiple AWS accounts. Which THREE components are required to securely deploy across accounts?

Accepted Answer

The pipeline's service role must have a trust policy allowing it to assume the target account role.. For cross-account deployments in CodePipeline, you need: A) the pipeline's service role must be allowed to assume the target account role, B) an IAM role in the target account with deploy permissions, and E) a customer-managed KMS key to encrypt artifacts. The artifact bucket is required but it resides in the pipeline account, not the target account, so option D as phrased is incorrect. A customer-managed KMS key is mandatory for cross-account artifact encryption; you cannot use the default S3-managed key for cross-account access.

Answer

A CodeCommit repository in each account.

Answer

An S3 artifact bucket that the pipeline can access in the target account.

Question 2

The exhibit shows an S3 bucket policy. If an IAM user in the same AWS account attempts to download an object from the bucket from IP address 203.0.113.5, what will happen?

Accepted Answer

The request will be denied.. The bucket policy allows GetObject only if the source IP is within 192.0.2.0/24. Since the IAM user's IP address (203.0.113.5) is outside that range, the Allow statement does not apply. With no applicable Allow, the default implicit deny takes effect, and the request is denied. IAM permissions cannot override a bucket policy's conditions; they only grant access if the policy also allows it. Therefore, the correct answer is D: the request will be denied.

Answer

The request will succeed because the user has IAM permissions.

Answer

The request will succeed because the user is in the same account.

Answer

The request will succeed because the bucket policy does not explicitly deny.

Question 3

A developer ran the AWS CLI command shown in the exhibit. What is the most likely cause of the error?

Accepted Answer

The AWS Region does not support CloudHSM custom key stores.. The error 'Custom key stores not supported in this region' indicates that the AWS region being used does not support CloudHSM-based custom key stores. To create a KMS key in a custom key store, the region must have CloudHSM support. Option A is incorrect because the --origin parameter is correctly spelled. Option B is incorrect because the --key-spec parameter is valid for custom key stores. Option C is incorrect because the error is about region support, not IAM permissions. Therefore, the most likely cause is that the region does not support CloudHSM custom key stores.

Answer

The --origin parameter is misspelled.

Answer

The --key-spec parameter is invalid for custom key stores.

Answer

The IAM user does not have permission to create KMS keys.

Question 4

The exhibit shows an IAM policy attached to a Lambda function's execution role. When the Lambda function tries to decrypt data using the KMS key, it receives an access denied error. What is the most likely cause?

Accepted Answer

The KMS key policy does not grant the Lambda execution role permission to use the key.. The policy attached to the Lambda execution role includes kms:Decrypt permission, so the function has the necessary action permission to call decrypt. However, for the Lambda function to decrypt using a KMS key, the key policy must explicitly grant the Lambda execution role permission to use the key. If the key policy does not include such a grant, the Lambda function will receive an access denied error even though its own policy is correct. Therefore, Option B is correct. Options A, C, and D are incorrect because the policy does include the correct action (kms:Decrypt), and the lack of kms:DescribeKey is not required for decryption.

Answer

The policy uses an incorrect action name for decryption.

Answer

The policy does not include kms:DescribeKey permission.

Answer

The policy does not include kms:Decrypt permission.

Question 5

A developer needs to allow an EC2 instance to read objects from a specific S3 bucket. Which is the MOST secure way to grant permissions?

Accepted Answer

Create an IAM role with S3 read permission and attach it to the EC2 instance as an instance profile. Create an IAM role with S3 read permission and attach it to the EC2 instance as an instance profile. This is the most secure method because it avoids hardcoding credentials and uses temporary credentials via the instance metadata service. Option A is incorrect because storing access keys in user data exposes them to anyone who can access the instance. Option B is incorrect because S3 bucket policies based on public IP are not recommended; IP addresses can change and do not authenticate the instance. Option D is incorrect because security groups control network traffic, not permissions to AWS services; they cannot grant read access to S3.

Answer

Store AWS access keys in the EC2 instance's user data

Answer

Use an S3 bucket policy that allows access from the EC2 instance's public IP

Answer

Attach a security group to the EC2 instance that allows S3 access

Question 6

A company wants to allow cross-account access to a DynamoDB table. They set up an IAM role in Account A (table owner) and allow Account B's users to assume the role. Which additional step is required?

Accepted Answer

Configure the trust policy of the IAM role in Account A to allow Account B to assume it. To allow cross-account access to a DynamoDB table, the IAM role in Account A (the table owner) must have a trust policy that explicitly grants permission to Account B's users or account to assume the role. This is the additional step beyond creating the role. Option A is incorrect because DynamoDB does not support resource-based policies on tables; access is controlled via IAM policies. Option B is incorrect because bucket policies are for S3, not DynamoDB. Option C is incorrect because while the IAM role does need a permissions policy allowing DynamoDB actions, the question asks for the additional step required; the permissions policy is typically part of creating the role, but the trust policy is the critical additional configuration for cross-account access.

Answer

Add a policy to the DynamoDB table allowing Account B

Answer

Create a bucket policy in Account A

Answer

Attach a policy to the IAM role that allows DynamoDB actions

Question 7

A developer is encrypting an S3 bucket using server-side encryption with AWS KMS (SSE-KMS). What is a benefit of using SSE-KMS over SSE-S3?

Accepted Answer

Ability to control access to the encryption key separately. SSE-KMS provides separate permissions for the encryption key, allowing fine-grained control. Option A is wrong because SSE-KMS can add latency due to KMS calls, so it does not reduce latency. Option B is wrong because SSE-KMS incurs additional KMS costs. Option D is wrong because automatic encryption at rest is also offered by SSE-S3, so it is not a unique benefit of SSE-KMS.

Answer

Reduced latency for encrypted object retrieval

Answer

Lower cost than SSE-S3

Answer

Automatic encryption of objects at rest

Question 8

A developer set up a Lambda function that reads from an SQS queue and processes messages. The function sometimes times out. How can the developer improve security while minimizing execution time?

Accepted Answer

Reduce the SQS visibility timeout to match the Lambda function's timeout. Reducing the SQS visibility timeout to match the Lambda function's timeout minimizes execution time by preventing duplicate processing: if the first invocation times out, the message becomes visible again only after the function has definitely stopped, avoiding wasted reprocessing. This also improves security by ensuring messages are not partially processed multiple times, which could lead to unintended operations or data exposure. Option A (encryption at rest) protects data but doesn’t affect execution time. Option B (DLQ) handles failures but doesn’t reduce execution time. Option C (increasing Lambda timeout) may extend processing time and doesn’t inherently improve security.

Answer

Use encryption at rest for the SQS queue

Answer

Enable a dead-letter queue (DLQ) for the SQS queue

Answer

Increase the Lambda function timeout to 15 minutes

Question 9

An application uses a custom KMS key to encrypt data. The application runs on an EC2 instance. To decrypt data, the application must call KMS. What is the BEST practice to securely provide the KMS key ID to the application?

Accepted Answer

Use an environment variable to pass the key ID to the application. The best practice is to use an environment variable to pass the KMS key ID to the application. This avoids hardcoding or storing the key ID in a file, which can be exposed. Option D is correct because environment variables are flexible and secure when managed properly. Option A is wrong because hardcoding the key ID in code is insecure and not maintainable. Option B is wrong because storing the key ID in a configuration file on the instance is less secure and can be accessed if the instance is compromised. Option C is wrong because an IAM role provides permissions but does not directly supply the key ID; the application would still need to retrieve it from somewhere else, such as an environment variable or parameter store.

Answer

Hardcode the key ID in the application code

Answer

Store the key ID in a configuration file on the instance

Answer

Retrieve the key ID using the instance's IAM role

Question 10

A developer wants to ensure that an S3 bucket only allows HTTPS requests. What S3 bucket policy condition should be used?

Accepted Answer

aws:SecureTransport. The aws:SecureTransport condition checks whether the request was sent using SSL/TLS, effectively enabling HTTPS-only access. Option A is incorrect because aws:CurrentTime is used to allow or deny access based on the time of the request. Option B is incorrect because aws:MultiFactorAuthPresent checks if the requester authenticated with multi-factor authentication. Option C is incorrect because aws:SourceIp is used to restrict requests based on the source IP address.

Answer

aws:CurrentTime

Answer

aws:MultiFactorAuthPresent

Answer

aws:SourceIp

Question 11

A developer is deploying an application with AWS CodeDeploy. The application needs to access a database password. Which service should be used to securely store and retrieve the password?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct service for securely storing and retrieving database passwords. It is specifically designed for secret management and provides automatic rotation, fine-grained access control, and integration with AWS CodeDeploy. AWS Systems Manager Parameter Store can store secrets but lacks automatic rotation unless integrated with Secrets Manager. AWS CloudFormation template parameters are not intended for secret storage and would expose the password in plaintext. Amazon DynamoDB with encryption at rest is a NoSQL database, not a dedicated secrets store, and managing access policies for secrets would be more complex.

Answer

AWS Systems Manager Parameter Store

Answer

AWS CloudFormation template parameters

Answer

Amazon DynamoDB with encryption at rest

Question 12

A company uses AWS KMS with imported key material. The key material is expired. What must the developer do to continue using the KMS key?

Accepted Answer

Delete the existing key and create a new one with new key material. Once imported key material expires, the KMS key cannot be used. The only way to continue using a KMS key with imported key material after expiration is to delete the existing key and create a new one with new key material. Option A is wrong because the key cannot be used after expiration. Option B is wrong because you cannot reimport the same key material into a new key; you must use new key material. Option C is wrong because automatic key rotation is not supported for imported key material.

Answer

Use the existing key until it expires

Answer

Create a new KMS key and re-import the same key material

Answer

Enable automatic key rotation

Question 13

A developer needs to grant least-privilege access to a Lambda function to write logs to CloudWatch Logs. Which IAM policy effect should be used?

Accepted Answer

Allow. The policy should explicitly allow the necessary actions for least-privilege access. Option A is wrong because 'Always allow' is not a valid IAM policy effect; the valid effects are 'Allow' and 'Deny'. Option C is wrong because 'Deny' would explicitly deny access, which does not grant the required permissions. Option D is wrong because 'Revoke' is not an IAM policy effect.

Answer

Always allow

Answer

Deny

Answer

Revoke

Question 14

A developer attached the above IAM policy to an IAM user. The user is trying to get an object from the bucket 'example-bucket' from an on-premises machine with public IP 203.0.113.5. What will happen?

Accepted Answer

Access is denied because the condition is not met. The IAM policy includes a condition that restricts the s3:GetObject action to requests originating from IP address 10.0.0.1/32. Since the user's request comes from public IP 203.0.113.5, the condition is not met. Therefore, despite the Allow effect, the request is denied because the condition fails. Option B correctly states that access is denied because the condition is not met.

Answer

Access is allowed because the user has an Allow effect

Answer

Access is allowed if the user uses a VPN with the specified IP

Answer

Access is allowed because the user's IP is not denied

Question 15

A developer runs the above command and gets the output shown. What is the developer verifying?

Accepted Answer

The size and ETag of an object in S3. The command retrieves attributes of an object, including its size and ETag. Option A is incorrect because encryption is not checked by this command. Option C is incorrect because version ID is not part of the output shown. Option D is incorrect because the command does not test permissions; it just returns the object metadata if the user has read access.

Answer

Whether the object is encrypted

Answer

The version ID of the object

Answer

Whether the user has permissions to access the object