DVA-C02 Security Practice Test 9 — 15 Questions

Question 1

A developer is building a serverless application using API Gateway and Lambda. The API must be accessible only from a specific VPC. How can the developer achieve this?

Accepted Answer

Create a VPC endpoint for API Gateway and attach a resource policy to the API that allows access only from the VPC endpoint.. You can create a VPC endpoint for API Gateway (interface endpoint) and then attach a resource policy to the API that allows access only from that VPC endpoint, effectively restricting access to the VPC. Option A is incorrect because API Gateway does not support security groups; security groups are for EC2 instances or other resources within a VPC. Option B is incorrect because API Gateway is a regional service that lives outside of any VPC; you cannot create an API Gateway inside a VPC. Option C is incorrect because CloudFront with OAI is used to restrict access to S3 origins, not to restrict API Gateway access to a VPC; it would not enforce VPC-only access.

Answer

Use security groups to restrict access to the API Gateway.

Answer

Create the API Gateway inside the VPC.

Answer

Use CloudFront with an origin access identity to restrict access.

Question 2

A company uses IAM roles to grant permissions to EC2 instances. The security team notices that an instance is using a role that has administrator privileges, which is a security risk. What is the BEST way to restrict the instance's permissions without disrupting the application?

Accepted Answer

Create a new IAM role with only required permissions, attach it to the instance profile, and update the instance to use the new profile.. The best approach because it allows you to create a new IAM role that grants only the necessary permissions, attach it to the instance profile, and then update the instance to use the new profile by associating the new instance profile with the EC2 instance. This minimizes disruption as the application continues running with the existing role until the instance is updated. Option A would cause downtime. Option C (modifying trust policy) would not effectively restrict permissions because the trust policy controls who can assume the role, not what permissions the role grants. Option D (permissions boundary) would limit maximum permissions but the existing role still has broad permissions, and a permissions boundary cannot be applied to an existing role without creating a new role or modifying the role's permissions; also it may not take effect immediately.

Answer

Remove the existing role from the instance and let the application fail.

Answer

Modify the trust policy of the existing role to deny access to the instance.

Answer

Attach a permissions boundary to the existing role that limits the maximum permissions.

Question 3

A developer needs to grant an IAM user the ability to create and manage CloudFormation stacks. Which IAM policy action should be allowed?

Accepted Answer

cloudformation:CreateStack. Option A (cloudformation:CreateStack). This action allows the IAM user to create and manage CloudFormation stacks. Option B (lambda:CreateFunction) is for creating Lambda functions, option C (ec2:RunInstances) is for launching EC2 instances, and option D (s3:CreateBucket) is for creating S3 buckets. None of these other actions are related to CloudFormation stack management.

Answer

lambda:CreateFunction

Answer

ec2:RunInstances

Answer

s3:CreateBucket

Question 4

A company uses AWS Organizations to manage multiple accounts. The security team wants to ensure that all S3 buckets across all accounts are encrypted with SSE-S3. What is the MOST effective way to enforce this?

Accepted Answer

Use an SCP in AWS Organizations to deny s3:PutBucketEncryption unless the encryption algorithm is AES256.. AWS Organizations allows you to create service control policies (SCPs) that can be applied to all accounts in the organization. An SCP can deny the s3:PutBucketEncryption action unless the encryption algorithm is AES256 (SSE-S3). This centrally enforces encryption across all accounts. Option A is incorrect because IAM policies must be attached to each user or group individually, and they cannot be enforced across all accounts centrally. Option B is reactive (detection only) and does not prevent non-compliant actions. Option D can enforce encryption on object uploads but does not prevent configuration of bucket-level encryption settings.

Answer

Create an IAM policy that denies non-SSE-S3 encryption and attach it to all users.

Answer

Use AWS Config rules to detect buckets without SSE-S3 and send alerts.

Answer

Use S3 bucket policies to deny PutObject if encryption is not SSE-S3.

Question 5

A developer is using AWS KMS to encrypt data. Which of the following are true about customer master keys (CMKs)? (Choose TWO.)

Accepted Answer

Customer managed keys can be rotated automatically every year.. Options D and E are correct. Customer managed keys (CMKs) can be created and managed by the user, and automatic yearly rotation can be enabled. AWS managed keys cannot be rotated by the customer, cannot be disabled or re-enabled, and incur per-request charges. Option A is incorrect because AWS managed keys cannot be disabled or re-enabled. Option B is incorrect because customer managed keys can be created by users. Option C is incorrect because AWS managed keys incur per-request charges.

Answer

You can disable and re-enable AWS managed keys.

Answer

You cannot create customer managed keys; only AWS can create them.

Answer

AWS managed keys are free with no usage charges.

Question 6

Refer to the exhibit. A developer attached this bucket policy to an S3 bucket named 'my-bucket'. The IAM role 'AppRole' is used by an application running on EC2 instances with an IP address of 192.0.2.10. The application tries to upload an object to 'my-bucket/confidential/report.pdf'. Will the upload succeed?

Accepted Answer

Yes, because the Deny statement uses a condition that does not match the application's IP.. The Deny statement in the bucket policy denies s3:PutObject on the 'confidential/' prefix with a condition that the source IP must not be from 192.0.2.0/24. Since the application's IP (192.0.2.10) is within that range, the condition is not met, so the Deny does not apply. The Allow statement grants s3:PutObject on the entire bucket, so the upload succeeds. Therefore, option D is correct. Option A is incorrect because the application already has the necessary permission via the bucket policy, and no additional IAM policy is required for the bucket policy to take effect. Option B is incorrect because the Deny does not apply due to the IP condition. Option C is incorrect because the Allow applies and the Deny does not.

Answer

Yes, but only if the application also has an IAM policy that allows s3:PutObject.

Answer

No, because the Deny statement denies all s3 actions on the 'confidential/' prefix.

Answer

No, because the Allow statement only allows GetObject and PutObject on the entire bucket, but the Deny overrides.

Question 7

Refer to the exhibit. A developer ran the above commands to inspect a KMS key. What can be determined about this key?

Accepted Answer

The key is a customer managed key.. The KeyManager field shows 'CUSTOMER', indicating it is a customer managed key. Option A is incorrect because KeyState is 'Enabled', so the key is not disabled. Option B is incorrect because MultiRegion is false, so the key is not multi-region. Option C is incorrect because the key is customer managed, not AWS managed.

Answer

The key is disabled.

Answer

The key can be used in multiple AWS regions.

Answer

The key is an AWS managed key.

Question 8

Refer to the exhibit. An IAM policy is attached to an IAM user. The user tries to download an object from 'example-bucket' from an IP address of 10.0.1.5. Will the download succeed?

Accepted Answer

Yes, because the source IP matches the condition.. The policy allows s3:GetObject on the bucket when the source IP is within 10.0.0.0/16. The user's IP 10.0.1.5 is within that range. Option B is incorrect because the IP is in the allowed range. Option C is incorrect because the condition is met. Option D is incorrect because the policy is sufficient.

Answer

No, because the policy does not specify the user's IP.

Answer

Yes, but only if the bucket policy also allows the access.

Answer

No, because the condition requires the IP to be in 10.0.0.0/16.

Question 9

A company is using AWS Lambda to process sensitive data. The Lambda function needs to access an S3 bucket in the same account. What is the BEST practice for granting permissions?

Accepted Answer

Create an IAM role with a policy granting S3 access and attach it to the Lambda function.. The best practice for granting permissions to an AWS Lambda function to access an S3 bucket is to create an IAM role with a policy that grants the necessary S3 permissions and attach that role to the Lambda function. This follows the principle of least privilege and avoids hard-coding credentials. Option A is not the best practice because while S3 bucket policies can be used, they are less flexible and do not follow the recommended pattern of using IAM roles for Lambda execution. Option B is the correct and recommended approach. Option C is irrelevant because Lambda does not use key pairs for authentication with AWS services. Option D is insecure and not a best practice because storing access keys in environment variables is vulnerable to exposure.

Answer

Use an S3 bucket policy that allows access from the Lambda function's ARN.

Answer

Generate a key pair and use it to authenticate the Lambda function to S3.

Answer

Store the AWS access key ID and secret access key in the Lambda environment variables.

Question 10

A developer is troubleshooting an application that uses an IAM role to access DynamoDB. The application is running on an EC2 instance and intermittently fails with an AccessDenied error. The IAM role has the following policy attached. What is the MOST likely cause?

Accepted Answer

The condition key aws:SourceIp might be blocking requests from the EC2 instance's IP.. The IAM policy allows all DynamoDB actions (dynamodb:*) on all tables, so the AccessDenied error is not due to missing actions or resource ARN. However, the condition `aws:SourceIp` restricts requests to specific IP addresses. If the EC2 instance's IP changes (e.g., due to NAT, Elastic IP reassignment, or scaling), the condition may deny access intermittently. Option C is correct.

Answer

The policy does not include the dynamodb:PutItem action.

Answer

The policy uses a NotAction element that inadvertently denies access.

Answer

The policy is missing the table ARN in the Resource field.

Question 11

A developer needs to securely store database credentials for a serverless application. Which service should be used?

Accepted Answer

AWS Secrets Manager.. AWS Secrets Manager is purpose-built for securely storing, managing, and automatically rotating secrets such as database credentials. Option A is wrong because Amazon S3 with server-side encryption is a general object storage service and lacks features like automatic rotation and fine-grained access control for secrets. Option B is wrong because AWS IAM manages identities and permissions, not secrets. Option C is wrong because AWS Systems Manager Parameter Store can store parameters but does not provide automatic rotation of secrets, which is a key requirement for database credentials.

Answer

Amazon S3 with server-side encryption.

Answer

AWS Identity and Access Management (IAM).

Answer

AWS Systems Manager Parameter Store.

Question 12

A company's S3 bucket contains sensitive data. The security team requires that all data be encrypted at rest. Which combination of actions will enforce encryption for all objects written to the bucket?

Accepted Answer

Enable default encryption on the bucket and apply a bucket policy that denies PutObject if the x-amz-server-side-encryption header is missing or set to None.. It combines enabling default encryption on the bucket with a bucket policy that denies PutObject requests when the x-amz-server-side-encryption header is missing or set to 'None'. This ensures that any object uploaded without encryption headers is rejected, and default encryption applies when the header is present but no encryption type is specified. Option B is incorrect because bucket ACLs cannot enforce encryption; they only grant permissions at the bucket or object level. Option C is incorrect because bucket ACLs alone cannot enforce encryption across all uploads. Option D is incorrect because a KMS key policy controls who can use the key, not whether encryption is applied during uploads.

Answer

Use bucket ACLs to grant write access only to users who use encryption.

Answer

Enable default encryption on the bucket and use bucket ACLs to restrict access.

Answer

Create an AWS KMS key and attach a key policy that requires encryption.

Question 13

A developer is deploying an application on EC2 instances behind an Application Load Balancer (ALB). The application must authenticate users using an identity provider (IdP) that supports OpenID Connect (OIDC). What is the MOST secure way to offload authentication to the ALB?

Accepted Answer

Configure the ALB with an OIDC identity provider and use the authenticate-oidc action.. The ALB supports OIDC authentication natively through the `authenticate-oidc` action, which securely offloads user authentication to the IdP. This is the most secure and efficient approach because it keeps authentication at the edge of the load balancer. Option B is incorrect because Lambda@Edge is used with CloudFront, not directly with ALB. Option C is incorrect because IAM federation is for granting AWS API access, not for web application authentication. Option D is incorrect because while Cognito User Pools can be used with ALB, the question specifies the organization already has an OIDC-compliant IdP; the ALB's native integration is more direct and secure than adding Cognito as an intermediary.

Answer

Use AWS Lambda@Edge to authenticate users at the CloudFront edge.

Answer

Use IAM federation to trust the IdP and assign IAM roles to users.

Answer

Use Amazon Cognito User Pools and configure the ALB to use Cognito as the authentication provider.

Question 14

A developer needs to grant an IAM user the ability to create and manage EC2 instances, but only in the us-east-1 region. Which IAM policy statement should be used?

Accepted Answer

{"Effect": "Allow", "Action": "ec2:*", "Resource": "*", "Condition": {"StringEquals": {"ec2:Region": "us-east-1"}}}. The Condition element with ec2:Region restricts the allowed actions to only the us-east-1 region, while allowing all EC2 actions (ec2:*). Option B is incorrect because it only permits Describe actions, not creating or managing instances. Option C is incorrect because although the Resource ARN includes the region, the ec2:* actions do not support resource-level restrictions with region in the ARN in the same way; a Condition is needed. Option D is incorrect because it allows EC2 actions in all regions with no restriction.

Answer

{"Effect": "Allow", "Action": "ec2:Describe*", "Resource": "*"}

Answer

{"Effect": "Allow", "Action": "ec2:*", "Resource": "arn:aws:ec2:us-east-1:*:*"}

Answer

{"Effect": "Allow", "Action": "ec2:*", "Resource": "*"}

Question 15

A company is using AWS Key Management Service (KMS) to encrypt data in S3. The security team wants to ensure that only the company's AWS account can access the KMS key. What should be done?

Accepted Answer

Modify the key policy to remove any statements that allow access from external AWS accounts.. Modifying the key policy to remove any statements that allow access from external AWS accounts ensures that only the company's AWS account can use the KMS key. The key policy explicitly defines who can access the key, and removing external account access restricts it to the key owner's account. Option A is incorrect because disabling the key prevents all use, not just external access. Option C is incorrect because an S3 bucket policy cannot control access to the KMS key itself; it only governs S3 operations. Option D is incorrect because IAM policies can grant or deny access, but the key policy must also allow the account; however, the key policy already allows the account's IAM users by default if they have the right permissions, but the requirement is to ensure only the company's account can access, which is achieved by removing external account access from the key policy.

Answer

Disable the KMS key and re-enable it only when needed.

Answer

Use an S3 bucket policy to deny access to any user not from the company's account.

Answer

Attach an IAM policy to the key that denies access to external accounts.