DVA-C02 Security Practice Test 8 — 15 Questions

Question 1

A developer needs to allow an Amazon EC2 instance to send messages to an Amazon SQS queue. What is the most secure way to grant this access?

Accepted Answer

Assign an IAM role to the EC2 instance with permissions to send messages to SQS. The most secure approach is to assign an IAM role to the EC2 instance with a policy that allows sqs:SendMessage for the queue. This avoids hardcoding credentials.

Answer

Create a bucket policy on S3 to allow EC2 to access SQS

Answer

Use a resource-based policy on the SQS queue allowing the EC2 instance's security group

Answer

Create an IAM user and store the credentials in the application configuration file

Question 2

A developer is using AWS Lambda to process files uploaded to an S3 bucket. The Lambda function needs to write logs to CloudWatch Logs. Which of the following is required to allow this?

Accepted Answer

Attach an IAM policy to the Lambda execution role with CloudWatch Logs permissions. The Lambda function's execution role must include a policy that allows logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents. This is the standard approach for Lambda logging.

Answer

Add a resource-based policy to the Lambda function

Answer

Configure the S3 bucket to trigger Lambda, and Lambda automatically logs to CloudWatch

Answer

Create an IAM role for CloudWatch Logs and assign it to the Lambda function

Question 3

A company wants to encrypt data in transit between an on-premises application and an Amazon RDS instance. Which of the following should be implemented?

Accepted Answer

Use SSL/TLS for the database connection. Encryption in transit is achieved by using SSL/TLS for the connection. RDS supports SSL/TLS connections to encrypt data moving between the client and the database.

Answer

Use an AWS Site-to-Site VPN connection

Answer

Place the RDS instance in a private subnet and use a bastion host

Answer

Enable encryption at rest on the RDS instance

Question 4

A developer is building a serverless application using AWS Lambda and Amazon API Gateway. The developer wants to restrict access to the API so that only authenticated users can invoke it. Which API Gateway feature should be used?

Accepted Answer

API Gateway Lambda authorizer. API Gateway supports AWS Lambda authorizers (formerly custom authorizers) that use a Lambda function to validate a bearer token, such as a JWT, from the client. This allows authentication before invoking the backend.

Answer

AWS WAF

Answer

API Gateway usage plan

Answer

API Gateway resource policy

Question 5

A developer is deploying a web application on Amazon ECS with a Fargate launch type. The application needs to securely access an Amazon DynamoDB table. How should the developer grant permissions?

Accepted Answer

Define a task role for the ECS task with DynamoDB permissions. For ECS tasks with Fargate, you define a task execution role and a task role. The task role grants permissions to the containers to access AWS services like DynamoDB.

Answer

Store AWS credentials in the container image

Answer

Assign an IAM role to the ECS service and use it from the container

Answer

Use an EC2 instance profile and mount it to the container

Question 6

A company is designing a secure CI/CD pipeline using AWS CodePipeline and AWS CodeBuild. The pipeline must securely store and access sensitive parameters (e.g., API keys) used during the build. Which TWO services can be used to securely store and retrieve these parameters?

Accepted Answer

AWS Systems Manager Parameter Store (SecureString). AWS Systems Manager Parameter Store (SecureString) and AWS Secrets Manager are both designed to securely store secrets and can be accessed by CodeBuild via IAM roles.

Answer

Amazon S3 with server-side encryption

Answer

AWS Key Management Service (KMS) alone

Answer

AWS CloudFormation parameter store

Question 7

A developer is creating an IAM policy to allow access to an Amazon DynamoDB table. The policy must allow the user to read and write items, but not to delete the table or modify its schema. Which TWO DynamoDB actions should be included in the policy?

Accepted Answer

GetItem. GetItem and PutItem are the actions for reading and writing individual items. DeleteTable and UpdateTable are administrative actions that should not be allowed.

Answer

UpdateTable

Answer

Scan

Answer

DeleteTable

Question 8

A developer attached the IAM policy above to an IAM user. What is the effect when the user tries to download an object from the 'confidential' folder in 'example-bucket'?

Accepted Answer

The user is denied access because of the explicit Deny statement. The policy has an explicit Deny for all s3 actions on the confidential folder. Explicit Deny overrides any Allow. Therefore, the user will be denied access even though the first statement allows GetObject on all objects.

Answer

The policy is invalid because Deny cannot be used with s3:*

Answer

The user can download only if the object is encrypted

Answer

The user can download the object because of the Allow statement

Question 9

A developer attached the managed policy above to an IAM role used by an application. The application tries to decrypt data using a KMS key that has an encryption context of {"department": "finance"}. However, the request fails with access denied. What is the most likely reason?

Accepted Answer

The KMS key policy does not grant decrypt permission to the IAM role. The policy uses a condition key kms:EncryptionContext:department, which requires the encryption context to match exactly. However, the context is a key-value pair; the condition must match both the key and the value. The policy might be correct, but the issue could be that the application does not pass the encryption context, or the KMS key policy does not grant access. The most likely reason is that the KMS key policy itself does not allow the IAM role to decrypt, because KMS requires both key policy and IAM policy to allow access.

Answer

The IAM role does not have permission to call kms:Decrypt on any key

Answer

The encryption context does not match the condition

Answer

The IAM policy does not allow the kms:Decrypt action

Question 10

The above resource-based policy is attached to an SQS queue. An application running on an EC2 instance with the IAM role 'AppRole' tries to send a message to the queue but receives an access denied error. What is the most likely cause?

Accepted Answer

The IAM role does not have an identity-based policy allowing sqs:SendMessage. The resource-based policy allows the role to send messages, but the role itself must also have an IAM policy that allows sqs:SendMessage. Without that, the request is denied because both the identity-based policy and the resource-based policy must grant access (unless one is an explicit deny).

Answer

The SQS queue is encrypted with a KMS key that the role cannot use

Answer

The principal ARN in the policy is incorrect

Answer

The SQS queue policy does not include the correct region

Question 11

A company is using AWS Secrets Manager to rotate database credentials automatically. The rotation Lambda function fails with a timeout error after 30 seconds. The developer checked the Lambda logs and saw that the function is making network calls to the database but never receives a response. What is the MOST likely cause?

Accepted Answer

The Lambda function is not attached to a VPC with a NAT gateway or VPC endpoints for Secrets Manager.. The most likely cause. When a Lambda function is configured to access a VPC, it loses internet connectivity by default unless the VPC has a NAT gateway or VPC interface endpoints. The Secrets Manager rotation Lambda needs to call the Secrets Manager API (which is outside the VPC) to retrieve the new secret. Without a NAT gateway or VPC endpoints, the call to Secrets Manager times out, and because the function is also trying to connect to the database (which may be in the same VPC or reachable), the entire function times out after 30 seconds. Option A is incorrect because insufficient memory would cause performance issues or out-of-memory errors, not network timeouts. Option B is incorrect because the timeout is 30 seconds, which is already quite long; increasing it further would not resolve the underlying connectivity issue. Option D is incorrect because if the credentials were incorrect, the database would reject the connection immediately, not cause a timeout; the function would get an authentication error rather than a timeout.

Answer

The Lambda function memory is insufficient; increase memory to 1024 MB.

Answer

The Lambda function timeout is set too low; increase it to 5 minutes.

Answer

The database credentials are incorrect; the rotation function cannot authenticate.

Question 12

A developer wants to grant an IAM user permissions to list all S3 buckets in the account, but deny access to a specific bucket named 'confidential-data'. Which IAM policy should be attached?

Accepted Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:ListBucket","Resource":"arn:aws:s3:::confidential-data"}]}. It grants s3:ListAllMyBuckets on all resources and explicitly denies s3:ListBucket on the specific bucket ARN for 'confidential-data'. Explicit deny overrides any allow. Option A denies all s3:ListBucket actions, preventing listing any bucket. Option B is invalid because the resource 'confidential-data' is not a valid ARN. Option D is syntactically valid but allows s3:ListBucket on 'confidential-data', which does not deny access and would grant listing that bucket, contrary to the requirement.

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:ListBucket","Resource":"*"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Deny","Action":"s3:ListBucket","Resource":"confidential-data"}]}

Answer

{"Version":"2012-10-17","Statement":[{"Effect":"Allow","Action":"s3:ListAllMyBuckets","Resource":"*"},{"Effect":"Allow","Action":"s3:ListBucket","Resource":"arn:aws:s3:::confidential-data"}]}

Question 13

A company uses AWS KMS to encrypt data at rest in S3. The security team requires that all encryption keys be rotated automatically every year. Which solution meets this requirement with the LEAST operational overhead?

Accepted Answer

Use an AWS managed key (aws/s3) for S3 encryption.. AWS managed keys (aws/s3) are automatically rotated annually by AWS, requiring zero operational overhead. Option B (customer managed key with automatic rotation) also supports automatic rotation but requires enabling it, adding minimal overhead, but AWS managed keys are simpler and have the least overhead. Option C (manual rotation) adds significant overhead. Option D (asymmetric key) is not suitable for S3 encryption and automatic rotation for asymmetric keys is not supported by default.

Answer

Use a customer managed key and enable automatic rotation.

Answer

Create a customer managed key and rotate it manually every year.

Answer

Use an asymmetric KMS key and rotate it automatically.

Question 14

A developer is deploying a web application on EC2 instances behind an Application Load Balancer. The application needs to authenticate users via a third-party identity provider (IdP) that supports OpenID Connect (OIDC). The developer wants to offload authentication to the ALB. Which configuration is required?

Accepted Answer

Register the third-party IdP as an OIDC identity provider in IAM, then configure the ALB listener rule to authenticate users using that provider.. ALB can authenticate users via OIDC by configuring a listener rule that uses an OIDC identity provider. The developer must register the third-party IdP as an OIDC identity provider in IAM, then configure the ALB listener rule to use that provider. Option A is incorrect because installing an OIDC client on EC2 instances would require the application to handle authentication itself, which the developer wants to offload to the ALB. Option B is incorrect because although Amazon Cognito can be integrated with ALB, it is an additional service; the third-party IdP already supports OIDC, so Cognito is not required. Option D is incorrect because IAM roles are for granting permissions to AWS services, not for user authentication via ALB.

Answer

Install and configure an OIDC client on the EC2 instances.

Answer

Configure Amazon Cognito as an identity provider and integrate with the ALB.

Answer

Create an IAM role for the EC2 instances that allows them to assume the identity of the user.

Question 15

A company wants to store sensitive data in S3. The data must be encrypted at rest using server-side encryption with a key that is automatically rotated annually. Which S3 encryption option should be used?

Accepted Answer

SSE-S3. SSE-S3 (Option B). SSE-S3 uses AWS-managed keys that are automatically rotated annually, meeting the requirement for automatic key rotation. Option A (client-side encryption) is not server-side. Option C (SSE-KMS with a customer managed key) requires you to manage key rotation, which is not automatic annually. Option D (SSE-C) uses customer-provided keys and does not manage rotation.

Answer

Client-side encryption

Answer

SSE-KMS with a customer managed key

Answer

SSE-C