DVA-C02 Security Practice Test 8 — 15 Questions

Question 1

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated every 90 days. Which key type should the company use to meet this requirement with minimal operational overhead?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Customer managed KMS key with automatic rotation enabled. Customer managed KMS keys support automatic rotation with a configurable rotation period. You can set the rotation period to 90, 180, or 365 days when enabling automatic rotation. This allows the company to meet the 90-day rotation requirement with minimal operational overhead, as AWS handles the rotation automatically. AWS managed keys and AWS owned keys do not allow custom rotation periods, and manual rotation (option A) requires significant overhead.

Answer

Customer managed KMS key with manual rotation

Answer

AWS managed KMS key

Answer

AWS owned KMS key

Question 2

Refer to the exhibit. A developer applies this IAM policy to an IAM user. What is the effective result when the user attempts to download an object from the 'confidential' folder in the 'my-company-data' bucket?

Accepted Answer

The user cannot download objects from the confidential folder due to the explicit Deny.. Without the IAM policy exhibit, it is impossible to verify if the policy is syntactically valid, if the Deny block is correctly structured, or if there are any other conflicting statements. Additionally, the explanation mentions 'using a condition with StringLike on the ARN', which is highly unusual for S3 path restrictions (which typically use the Resource element or s3:prefix condition keys), suggesting the underlying policy might contain technical inaccuracies.

Answer

The user can download objects from the confidential folder but cannot upload to it.

Answer

The user cannot download objects from any folder because the policy is invalid.

Answer

The user can download objects from the confidential folder because the Allow statement grants access.

Question 3

A developer is troubleshooting an issue where an IAM role assumed by an EC2 instance does not have permission to call the DynamoDB PutItem API. The role has a policy that allows all DynamoDB actions on a specific table. Which of the following is the most likely cause?

Accepted Answer

The IAM role policy does not include the 'dynamodb:PutItem' action or the resource ARN is incorrect.. An AccessDenied exception indicates an authorization failure. For the EC2 instance to successfully call `PutItem` on the DynamoDB table, the attached IAM role must have a policy that explicitly allows the `dynamodb:PutItem` action on the specific table's Amazon Resource Name (ARN). If the action is missing or the ARN is incorrect/mismatched, IAM will deny the request. Network issues (Option D) would result in connection timeouts, and region mismatches (Option B) typically result in ResourceNotFound exceptions, not AccessDenied.

Answer

The IAM role has not been attached to the EC2 instance profile.

Answer

The DynamoDB table is not in the same region as the EC2 instance.

Answer

The EC2 instance does not have the necessary network connectivity to DynamoDB.

Question 4

Refer to the exhibit. A developer runs the AWS CLI command to decrypt a file using a KMS key alias 'my-key' and receives the error shown. The developer has an IAM policy that allows 'kms:Decrypt' on 'arn:aws:kms:us-east-1:123456789012:key/abcd1234-...'. Which additional step is required to resolve this error?

Accepted Answer

Enable IAM user permissions in the KMS key policy.. By default, KMS keys do not allow IAM policies to grant access unless the KMS key policy explicitly enables IAM user permissions (using the root principal `arn:aws:iam::123456789012:root`). Since the developer already has an IAM policy allowing `kms:Decrypt` on the key ARN, enabling IAM user permissions in the KMS key policy will allow that existing IAM policy to take effect and resolve the AccessDeniedException.

Answer

Add the user's ARN to the KMS key policy with 'kms:Decrypt' permission.

Answer

Attach a policy to the user that allows 'kms:DescribeKey' on the key.

Answer

Use the key ID instead of the alias in the command.

Question 5

A developer is troubleshooting an issue where an AWS Lambda function cannot write logs to Amazon CloudWatch Logs. The Lambda function has an execution role with a policy that allows logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. Which additional configuration is likely missing?

Accepted Answer

The log group name must start with '/aws/lambda/'.. When a CloudWatch Logs log group is encrypted with a customer managed KMS key, the CloudWatch Logs service itself performs the encryption/decryption of the log data. Therefore, the KMS key policy must explicitly grant the CloudWatch Logs service principal (logs.amazonaws.com or logs.<region>.amazonaws.com) the permissions to use the key (such as kms:Encrypt, kms:Decrypt, kms:GenerateDataKey, etc.). The Lambda function's execution role does not need these KMS permissions because the function writes logs to stdout/stderr, and the Lambda service handles sending them to CloudWatch Logs.

Answer

The CloudWatch Logs log group is encrypted with a customer-managed KMS key.

Answer

The Lambda function is in a VPC without a VPC endpoint for CloudWatch Logs.

Answer

The Lambda function is not configured with a log group name.

Question 6

An IAM policy is attached to a user. The user tries to delete an object in 'example-bucket' from IP address 198.51.100.5. What happens?

Accepted Answer

The user is denied from deleting the object.. The question stem refers to 'An IAM policy' and the explanation mentions an explicit Deny statement and an Allow statement, but no policy JSON is actually provided in the stem. We must include the IAM policy JSON in the stem so the question can be answered.

Answer

The user can delete the object because the Allow statement grants all actions on the bucket.

Answer

The user can delete the object because there is no explicit Deny for their IP.

Answer

The user can delete the object because the Deny condition is met.

Question 7

An EC2 instance is running with an IAM instance profile. The application on the instance is trying to access an S3 bucket, but receives 'Access Denied'. The instance profile has a role with a policy that allows s3:GetObject on the bucket. What is a likely cause?

Accepted Answer

The instance is in a private subnet without a VPC endpoint for S3.. When an S3 bucket is encrypted using a Customer Managed Key (CMK) in AWS KMS, any user or role attempting to retrieve objects from the bucket (using s3:GetObject) must also have permission to decrypt the objects using that KMS key (kms:Decrypt). Without the kms:Decrypt permission in the IAM role's policy (or the KMS key policy), AWS S3 will return an 'Access Denied' error even if the S3 permissions themselves are correct.

A missing VPC endpoint or network path (Option B) would result in a connection timeout, not an 'Access Denied' error, because the request would never reach the S3 service to be evaluated.

Answer

The instance profile is not attached to the instance.

Answer

The IAM role does not have the correct permissions.

Answer

The trust policy of the IAM role does not allow the EC2 service.

Question 8

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated automatically every 365 days. Which type of KMS key should be used?

Accepted Answer

Use an AWS managed key (e.g., aws/s3).. AWS managed keys (e.g., aws/s3) automatically rotate every year (365 days) without any configuration or administrative action required, making them the solution with the least operational effort. While customer managed keys also support automatic rotation every 365 days, they require manual configuration to enable this feature.

Answer

Use a custom key store with automatic rotation enabled.

Answer

Use a key with imported key material and set a rotation period of 365 days.

Answer

Use a customer managed key with automatic rotation enabled.

Question 9

A company is using AWS CodeCommit and wants to ensure that all commits are signed with a GPG key. What must the developer configure?

Accepted Answer

Create a repository policy that requires commits to be signed.. AWS CodeCommit does not have resource-based 'repository policies' (permissions are managed via IAM identity-based policies). Furthermore, CodeCommit does not natively validate GPG signatures on commits, nor does it support pre-receive hooks to block unsigned commits. The features described in the explanation and Option D are entirely hallucinated.

Answer

Ask developers to sign commits using git commit -S.

Answer

Configure an SSH key in the IAM user.

Answer

Use HTTPS with a password.

Question 10

A developer is deploying a web application on EC2 instances behind an Application Load Balancer (ALB). The application uses HTTPS. The developer creates a certificate in AWS Certificate Manager (ACM) and associates it with the ALB listener on port 443. However, when users access the application, they receive a browser warning that the connection is not secure. The ALB is configured with a default SSL/TLS policy. What is the most likely cause of the issue?

Accepted Answer

The certificate is in a different region than the ALB.. ACM certificates are bound to specific domain names (such as `example.com` or `*.example.com`). When a client connects to the ALB using its default DNS name (`*.elb.amazonaws.com`), the browser detects a mismatch between the requested domain name and the domain name on the SSL/TLS certificate, resulting in a 'Not Secure' or hostname mismatch warning. To resolve this, the developer should configure a custom domain name in Route 53 (or another DNS provider) pointing to the ALB via an Alias or CNAME record, and access the application using that custom domain.

Answer

The certificate was not imported correctly into ACM.

Answer

The ALB is using an outdated SSL/TLS policy.

Answer

The ALB cannot terminate HTTPS; the developer must configure HTTPS on the EC2 instances.

Question 11

A company wants to encrypt data at rest in an S3 bucket. Which AWS service can provide encryption keys that are managed by AWS and rotated automatically?

Accepted Answer

SSE-KMS (Server-Side Encryption with AWS KMS). SSE-KMS (Server-Side Encryption with AWS KMS keys) allows you to use AWS KMS to encrypt your S3 objects. AWS KMS provides AWS managed keys (such as `aws/s3`) which are managed by AWS and rotated automatically every year. Additionally, AWS KMS provides a complete audit trail of key usage via AWS CloudTrail, allowing you to track when and by whom a key was used. SSE-S3 also manages and rotates keys automatically, but it does not provide an audit trail of key usage.

Answer

SSE-S3 (Server-Side Encryption with S3 Managed Keys)

Answer

SSE-C (Server-Side Encryption with Customer-Provided Keys)

Answer

Client-side encryption using AWS KMS.

Question 12

A developer is deploying an application on EC2 instances behind an Application Load Balancer. The application must support mutual TLS (mTLS) authentication between clients and the load balancer. Which configuration is required?

Accepted Answer

Create a trust store in AWS Certificate Manager Private CA and associate it with the ALB.. Mutual TLS (mTLS) on an Application Load Balancer (ALB) requires a trust store containing the trusted Certificate Authority (CA) certificates used to validate client certificates. This trust store is created and managed directly within Elastic Load Balancing (ELB) and then associated with the ALB's listener. The ALB then performs client certificate verification during the TLS handshake, offloading this overhead from the backend EC2 instances.

Answer

Use a Network Load Balancer (NLB) with TLS listeners.

Answer

Configure listener rules on the ALB to require client certificates.

Answer

Use Amazon CloudFront with a custom origin and require client certificates.

Question 13

A developer is configuring an S3 bucket to host a static website. The bucket must be accessible to anyone on the internet, but only for reading objects. Which THREE steps are necessary? (Choose THREE.)

Accepted Answer

Enable static website hosting on the bucket.. Option C is correct because enabling static website hosting on the bucket is what activates the S3 website endpoint and allows the bucket to serve index and error documents as a website. Option D is correct because S3 Block Public Access settings, when enabled, override ACLs and bucket policies, so they must be disabled for the bucket before public read access can actually take effect. Option E is correct because a bucket policy granting s3:GetObject to Principal "*" explicitly allows anonymous internet users to read objects, which is the required read-only public access. Option A is not necessary because public-read ACLs are legacy and can be blocked by Block Public Access; a bucket policy is the recommended way to grant public read access. Option B is not required because CloudFront is an optional CDN layer and is not needed to host a static website directly from an S3 website endpoint.

Answer

Set the bucket ACL to public-read.

Answer

Create an Amazon CloudFront distribution with the bucket as origin.

Question 14

A company wants to use AWS KMS to encrypt data in an S3 bucket. They need to rotate the CMK annually. Which key type should they use to enable automatic rotation?

Accepted Answer

AWS managed key (aws/s3). AWS managed keys (aws/s3) support automatic annual rotation automatically without any configuration. When you use an AWS managed key for S3, AWS KMS rotates the key material once every year, which satisfies the requirement for annual rotation without manual intervention.

Answer

Customer managed key (CMK)

Answer

Custom key store

Answer

AWS owned key

Question 15

A developer needs to temporarily grant an IAM user permissions to perform a specific task. The permissions should expire after 12 hours. Which approach should the developer use?

Accepted Answer

Use AWS STS to generate temporary security credentials.. AWS Security Token Service (STS) can generate temporary security credentials that are valid for a configurable duration, up to a maximum of 12 hours for IAM users. This allows the developer to grant permissions that automatically expire without manual intervention, meeting the requirement precisely.

Answer

Attach a policy to the user and detach it after 12 hours.

Answer

Use cross-account IAM roles.

Answer

Create a new IAM user with the required permissions and delete the user after 12 hours.