DVA-C02 Security Practice Test 8 — 15 Questions

Question 1

A developer notices that an IAM user has permissions to terminate EC2 instances, but the user should only be allowed to stop instances. The developer needs to update the policy to prevent termination while allowing stop. Which IAM policy statement should be added?

Accepted Answer

{"Effect":"Deny","Action":"ec2:TerminateInstances","Resource":"*"}. Option B is correct because a Deny statement for ec2:TerminateInstances will explicitly block termination, overriding any Allow. Option A is wrong because it allows termination. Option C is wrong because it allows both. Option D is wrong because ec2:RebootInstances is unrelated.

Answer

{"Effect":"Allow","Action":"ec2:TerminateInstances","Resource":"*"}

Answer

{"Effect":"Allow","Action":["ec2:StopInstances","ec2:TerminateInstances"],"Resource":"*"}

Answer

{"Effect":"Allow","Action":"ec2:RebootInstances","Resource":"*"}

Question 2

A developer wants to encrypt data in transit between an application and an S3 bucket. Which option achieves this?

Accepted Answer

Use HTTPS when making requests to S3.. Option A is correct because HTTPS provides encryption in transit. Option B is wrong because SSE-S3 encrypts at rest, not in transit. Option C is wrong because SSE-KMS encrypts at rest. Option D is wrong because IAM is for access control.

Answer

Enable server-side encryption with S3 managed keys (SSE-S3).

Answer

Configure an IAM policy to require encryption.

Answer

Use AWS KMS to encrypt the data before upload.

Question 3

A company has an S3 bucket with a policy that denies access to all users. The bucket owner wants to grant read access to a specific IAM user. What must be done?

Accepted Answer

Remove the Deny statement from the bucket policy.. Option C is correct because an explicit deny in a bucket policy overrides any allow. The deny must be removed or modified. Option A is wrong because the bucket policy's explicit deny overrides. Option B is wrong because ACLs are legacy and still overridden by explicit deny. Option D is wrong because cross-account is not the issue.

Answer

Create a new bucket and copy objects there.

Answer

Add an Allow statement in the bucket policy for the user.

Answer

Add the user to the bucket ACL with read permission.

Question 4

A developer is designing a system that must meet the following security requirements: (1) Encrypt data at rest in S3, (2) Automatically rotate encryption keys annually, (3) Use an encryption key that is managed by AWS. Which services or features should the developer use? (Choose TWO.)

Accepted Answer

SSE-KMS. Option A (SSE-S3) and Option E (SSE-KMS) are correct because both provide encryption at rest with AWS-managed keys. SSE-KMS supports automatic annual rotation (if KMS key rotation is enabled). SSE-S3 uses S3-managed keys which rotate automatically. Option B (SSE-C) uses customer-provided keys, not AWS-managed. Option C (CloudHSM) is customer-managed. Option D (client-side encryption) is not AWS-managed.

Answer

SSE-C

Answer

AWS CloudHSM

Answer

Client-side encryption with AWS KMS

Question 5

A developer is troubleshooting an issue where an EC2 instance cannot access an S3 bucket despite having an IAM role with the correct permissions attached. Which THREE steps should the developer take to diagnose the issue?

Accepted Answer

Use the AWS CLI command 'aws sts assume-role' to test the role credentials.. Option A, C, and E are correct. Option A verifies permissions. Option C checks if the instance actually has the role. Option E ensures the instance is in the correct region or service is up. Option B is wrong because modifying the bucket policy is not a diagnostic step. Option D is wrong because security groups do not affect S3 access via IAM roles.

Answer

Check the security group of the EC2 instance for outbound rules.

Answer

Modify the S3 bucket policy to grant access to the instance's security group.

Question 6

Which TWO of the following are best practices for securing AWS account root user?

Accepted Answer

Delete the root user access keys.. Option B and C are correct. Option B: MFA adds extra security. Option C: Access keys should be deleted to prevent misuse. Option A is wrong because root user should not be used for daily tasks. Option D is wrong because root user is not automatically locked. Option E is wrong because sharing password is insecure.

Answer

Use the root user for daily administrative tasks.

Answer

Set a password policy that locks the root user after 10 failed attempts.

Answer

Share the root user password with senior developers for emergencies.

Question 7

A developer is using AWS Lambda and needs to ensure that the function can access an RDS database securely. Which THREE steps should be taken?

Accepted Answer

Place the Lambda function inside a VPC.. Option A, C, and E are correct. Option A: Lambda should be in a VPC to access RDS privately. Option C: Database credentials should be stored in Secrets Manager. Option E: Security group should allow ingress from Lambda. Option B is wrong because Lambda does not use IAM roles for database authentication (it uses traditional credentials). Option D is wrong because Lambda cannot use client certificates for RDS.

Answer

Attach an IAM role to the Lambda function that grants rds:* permissions.

Answer

Configure the RDS instance to require client certificates.

Question 8

Refer to the exhibit. An IAM policy is attached to a user. The user attempts to download an object from my-bucket that was uploaded without server-side encryption. What happens?

Accepted Answer

The request is denied because the object is not encrypted with SSE-KMS.. Option B is correct because the condition requires the object to have SSE-KMS encryption. Since the object was uploaded without encryption, the condition is not met, and the request is denied. Option A is wrong because the policy does not allow unencrypted access. Option C is wrong because the condition applies to GetObject, not just PutObject. Option D is wrong because AWS does not automatically encrypt at rest by default.

Answer

The request succeeds because the condition only applies to PutObject.

Answer

The request is denied because the bucket policy requires encryption.

Answer

The request succeeds because the policy allows s3:GetObject.

Question 9

Refer to the exhibit. A developer in account 111111111111 tries to assume a role in account 123456789012. The error occurs. What is the MOST likely cause?

Accepted Answer

The user does not have sts:AssumeRole permission on the target role.. Option C is correct because cross-account role assumption requires both a trust policy on the role allowing the user's account and an IAM policy granting the user sts:AssumeRole. The error indicates the user is not authorized, likely because of missing permissions on the user side (or trust policy). Option A is wrong because the error is AccessDenied, not access key issue. Option B is wrong because the role name is provided correctly. Option D is wrong because region is not required for this API call.

Answer

The role does not exist in the us-east-1 region.

Answer

The access keys used are expired.

Answer

The role ARN is incorrect.

Question 10

A company is using an Application Load Balancer (ALB) to route traffic to a set of EC2 instances. The security team wants to ensure that only traffic from the ALB can reach the instances. Which security group configuration should be used?

Accepted Answer

Configure the EC2 instance security group to allow traffic from the ALB security group.. Option A is correct because referencing the ALB security group as the source in the EC2 instance security group ensures that only traffic originating from the ALB is allowed. Option B is wrong because the ALB's private IP addresses can change if the ALB scales. Option C is wrong because a network ACL does not support security group IDs as sources. Option D is wrong because allowing all HTTP traffic would defeat the purpose of restricting traffic to the ALB only.

Answer

Configure the EC2 instance security group to allow traffic from the ALB's private IP address range.

Answer

Configure the network ACL for the EC2 instance subnet to allow traffic from the ALB security group.

Answer

Configure the EC2 instance security group to allow HTTP traffic from 0.0.0.0/0.

Question 11

A developer needs to grant an IAM user access to an S3 bucket for read-only operations. Which IAM policy action should be used?

Accepted Answer

s3:GetObject. Option B is correct because s3:GetObject allows reading objects from S3. Option A is wrong because s3:PutObject allows writing. Option C is wrong because s3:ListBucket allows listing but not reading object content. Option D is wrong because s3:DeleteObject allows deletion.

Answer

s3:PutObject

Answer

s3:DeleteObject

Answer

s3:ListBucket

Question 12

A company has an S3 bucket configured with server-side encryption using AWS KMS (SSE-KMS). An application running on EC2 with an appropriate IAM role is unable to write objects to the bucket. The error message indicates an access denied error. Which additional permission is most likely required?

Accepted Answer

kms:GenerateDataKey. Option D is correct because with SSE-KMS, the IAM role must have kms:GenerateDataKey permission to encrypt the object. Option A is wrong because kms:Decrypt is for reading. Option B is wrong because kms:Encrypt is used for client-side encryption, but for SSE-KMS, the S3 service uses GenerateDataKey. Option C is wrong because kms:ReEncrypt is for re-encryption.

Answer

kms:Decrypt

Answer

kms:Encrypt

Answer

kms:ReEncrypt

Question 13

A developer is building a serverless application using AWS Lambda and needs to securely store database credentials. Which AWS service should be used to store and retrieve the credentials?

Accepted Answer

AWS Secrets Manager. Option B is correct because AWS Secrets Manager is designed to securely store and automatically rotate secrets such as database credentials. Option A is wrong because SSM Parameter Store can store parameters but lacks automatic rotation. Option C is wrong because KMS is for encryption keys, not credential storage. Option D is wrong because CloudFormation is for infrastructure as code.

Answer

AWS CloudFormation

Answer

AWS Systems Manager Parameter Store

Answer

AWS Key Management Service (KMS)

Question 14

A company wants to encrypt data at rest in an Amazon RDS for PostgreSQL database. The database is already running, and the company wants to enable encryption without significant downtime. Which approach should be taken?

Accepted Answer

Take a snapshot, copy the snapshot with encryption, and restore a new encrypted instance from the encrypted snapshot.. Option D is correct because you cannot encrypt an existing unencrypted RDS instance; you must create a snapshot, copy it with encryption, and restore a new encrypted instance. Option A is wrong because you cannot modify the instance to enable encryption directly. Option B is wrong because you cannot attach a KMS key to an existing instance. Option C is wrong because you cannot encrypt an existing snapshot; you must copy it with encryption.

Answer

Take a snapshot of the database and enable encryption on the snapshot.

Answer

Modify the RDS instance and enable encryption in the configuration.

Answer

Create a read replica with encryption and promote it.

Question 15

A developer needs to allow an IAM user to stop and start EC2 instances but not terminate them. Which IAM policy effect and action combination should be used?

Accepted Answer

Allow ec2:StopInstances and ec2:StartInstances. Option A is correct because the policy should allow ec2:StopInstances and ec2:StartInstances, but not ec2:TerminateInstances. Option B is wrong because Deny would block all actions. Option C is wrong because it includes ec2:TerminateInstances. Option D is wrong because it also includes termination.

Answer

Allow ec2:StopInstances, ec2:StartInstances, and ec2:TerminateInstances

Answer

Deny ec2:TerminateInstances

Answer

Allow ec2:StartInstances and ec2:TerminateInstances