DVA-C02 Security Practice Test 7 — 15 Questions

Question 1

A developer attaches the above S3 bucket policy to my-bucket. A user tries to upload an object using HTTP (not HTTPS). What will happen?

Accepted Answer

The upload is denied. The bucket policy includes a Deny statement that denies s3:PutObject when the condition aws:SecureTransport equals false. Since the user is using HTTP (not HTTPS), SecureTransport is false, so the Deny applies and the upload is denied. Option A is wrong because the Deny effect does apply when the condition is true. Option B is wrong because even if the user has an Allow from another policy, an explicit Deny always overrides any Allow. Option D is wrong because the Deny statement explicitly denies the action; an explicit Deny does not require a matching Allow statement to be effective.

Answer

The upload succeeds because the Deny effect only applies if the condition is true

Answer

The upload succeeds if the user also has an Allow in another policy

Answer

The upload succeeds because there is no Allow statement

Question 2

A developer is troubleshooting an S3 bucket policy that is denying all access. The policy has an explicit Deny for s3:PutObject. What is the most likely reason for the denial even though an Allow exists?

Accepted Answer

IAM evaluates explicit Deny before Allow.. IAM evaluates explicit Deny before Allow, so an explicit Deny overrides any Allow.

Answer

The bucket policy has an explicit Deny for all actions.

Answer

The user is not authorized because the bucket is in a different account.

Answer

The AWS account root user has denied access.

Question 3

A company wants to securely store database credentials for a Lambda function. Which AWS service should be used?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is designed for storing secrets like database credentials with automatic rotation.

Answer

AWS CloudHSM

Answer

AWS Systems Manager Parameter Store (Standard tier)

Answer

Amazon S3 with server-side encryption

Question 4

A developer is designing a multi-tier application. The web tier must be accessible from the internet, while the application tier should only be accessible from the web tier. Which security group configuration meets these requirements?

Accepted Answer

Web tier SG allows inbound 0.0.0.0/0 on port 80; Application tier SG allows inbound from web tier SG on port 8080.. Application tier security group should allow inbound traffic only from the web tier security group, not from the internet or CIDR ranges.

Answer

Web tier SG allows inbound from application tier SG.

Answer

Both SGs allow inbound 0.0.0.0/0 on necessary ports.

Answer

Web tier SG allows inbound 0.0.0.0/0 on port 80; Application tier SG allows inbound from 0.0.0.0/0 on port 443.

Question 5

A developer needs to grant an IAM user access to an S3 bucket owned by another AWS account. Which method should be used?

Accepted Answer

Attach a bucket policy to the bucket that allows the user's IAM user ARN.. Cross-account access requires a bucket policy in the account owning the bucket, granting access to the IAM user ARN from the other account.

Answer

Create an IAM role in the bucket owner account and allow the user to assume it.

Answer

Create a new IAM user in the bucket owner account for the developer.

Answer

Add the user to a bucket ACL granting access.

Question 6

A company uses AWS KMS to encrypt data at rest. A developer wants to allow a Lambda function to decrypt data using a KMS key. What is the minimum permissions required?

Accepted Answer

kms:Decrypt on the key in the Lambda execution role.. The Lambda function's execution role needs kms:Decrypt permission for the specific key.

Answer

kms:Decrypt on all keys.

Answer

kms:Encrypt and kms:Decrypt on the key.

Answer

Full access to KMS.

Question 7

A developer needs to allow an EC2 instance to access an S3 bucket without storing credentials on the instance. Which approach is the most secure?

Accepted Answer

Use an IAM role for EC2 with a policy granting S3 access.. An IAM role attached to the EC2 instance provides temporary credentials via instance metadata, avoiding hardcoded keys.

Answer

Create an IAM user with access keys and store them on the instance.

Answer

Use S3 bucket policy to allow the EC2 instance's public IP.

Answer

Store the access keys in Systems Manager Parameter Store and retrieve at runtime.

Question 8

A company is using AWS CloudTrail to monitor API activity. A developer notices that some actions are not logged. What is a possible reason?

Accepted Answer

Some services are not integrated with CloudTrail.. CloudTrail does not log all AWS services by default; some services must be enabled separately.

Answer

CloudTrail only logs read events.

Answer

CloudTrail has a 24-hour delay.

Answer

The CloudTrail trail is not enabled in the correct region.

Question 9

A developer is building a serverless application using API Gateway and Lambda. The API must be accessed only by authenticated users from a specific AWS Cognito User Pool. Which method should be used?

Accepted Answer

Configure a Cognito Authorizer on the API Gateway method.. API Gateway can use a Cognito Authorizer to validate tokens from a specific user pool.

Answer

Create a Lambda authorizer that checks the token against Cognito.

Answer

Use an IAM authorizer with a policy that allows only Cognito roles.

Answer

Use a resource policy on API Gateway to restrict by source IP.

Question 10

A developer attaches this IAM policy to an IAM user. The user is trying to access an object in example-bucket from an IP address 203.0.113.5. What will happen?

Accepted Answer

Access is denied because the condition is not satisfied.. The policy allows access only from the 192.0.2.0/24 range. The user's IP 203.0.113.5 is outside that range, so access is implicitly denied.

Answer

Access is allowed because the condition is not mandatory.

Answer

Access is denied because the resource ARN is incorrect.

Answer

Access is allowed because the policy allows the action.

Question 11

A developer runs the AWS CLI command to decrypt a file using a KMS key. What is the most likely cause of the error?

Accepted Answer

The IAM user lacks kms:Decrypt permission on the key.. The IAM user DevUser does not have kms:Decrypt permission on the specified KMS key.

Answer

The encrypted file is corrupted.

Answer

The CLI cannot read the file.

Answer

The KMS key ID is incorrect.

Question 12

A company is using AWS KMS to encrypt data at rest in Amazon S3. The security team requires that all encryption keys be rotated automatically every 12 months. Which type of KMS key should be used?

Accepted Answer

AWS managed key. AWS managed keys are automatically rotated every year. Customer managed keys support automatic rotation, but the default rotation period is 1 year. Custom key stores do not support automatic rotation. AWS managed keys are the simplest way to meet the requirement.

Answer

Custom key store (CloudHSM)

Answer

AWS owned key

Answer

Customer managed key

Question 13

A developer is creating an IAM policy for an Amazon S3 bucket that must allow read access to a specific object only. Which policy element should be used to restrict access to the object?

Accepted Answer

Resource. The Resource element in an IAM policy specifies the ARN of the resource. For S3, the ARN format is arn:aws:s3:::bucket-name/key. Using a specific object ARN restricts access to that object only.

Answer

Action

Answer

Condition

Answer

Principal

Question 14

A developer is troubleshooting access to an Amazon S3 bucket. The bucket policy allows access to the developer's IAM role, but the developer receives an Access Denied error when trying to upload objects. The developer is using an IAM user with access keys for API calls. What is the most likely cause?

Accepted Answer

The bucket policy allows the role ARN, but the developer is using user credentials. When using IAM user credentials, the bucket policy must grant access to the IAM user ARN, not the role ARN. The developer is using user credentials, so the bucket policy should reference the user, not the role.

Answer

The developer’s IAM user does not have s3:PutObject permission

Answer

The bucket policy does not include a Principal element

Answer

The S3 bucket is in a different region from the developer's API endpoint

Question 15

A company uses AWS Secrets Manager to store database credentials. The application runs on Amazon EC2 instances with an IAM role attached. How should the application retrieve the secret securely?

Accepted Answer

Store the secret ID in an environment variable and use the AWS SDK to retrieve it. The best practice is to use the IAM role to call Secrets Manager APIs. The role must have a policy allowing secretsmanager:GetSecretValue. The application can then retrieve the secret at runtime using the AWS SDK.

Answer

Use AWS Systems Manager Parameter Store with a secure string parameter

Answer

Store the secret in an S3 bucket with server-side encryption

Answer

Hardcode the secret in the application code