DVA-C02 Security — Timed 15 Questions

Question 1

A company has an AWS Lambda function that processes sensitive financial data. The function uses environment variables to store database connection strings. A security audit requires that all sensitive data be encrypted at rest and in transit. The developer must ensure that the environment variables are encrypted with a customer-managed key that is rotated quarterly. What should the developer do?

15 minute time limit — choose an answer to begin.

Accepted Answer

Store the connection string in AWS Secrets Manager and enable automatic rotation with a custom Lambda function. To resolve this contradiction, the stem has been updated to focus on securing and rotating the database credentials currently stored in the environment variables. AWS Secrets Manager is the best practice for storing, encrypting with a customer-managed KMS key, and automatically rotating database credentials every 90 days (quarterly).

Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter using an AWS managed key

Answer

Encrypt the environment variables using the Lambda service key

Answer

Use AWS KMS to encrypt the environment variables and set a manual rotation policy

Question 2

A company wants to grant a third-party vendor access to an Amazon S3 bucket in the company's AWS account. The vendor has their own AWS account. The company requires the vendor to include a unique identifier in each request to verify their identity before granting access. Which policy element should the company include in the S3 bucket policy?

Accepted Answer

Condition with sts:ExternalId. The `sts:ExternalId` condition key is specifically designed for scenarios where a third party (the vendor) needs to access AWS resources in your account, and you want to ensure that the vendor includes a unique identifier in each request. This prevents the confused deputy problem by requiring the vendor to pass the external ID in the `AssumeRole` call. By including this condition in the IAM role's trust policy, the company can verify that the request originates from the intended vendor and not from another entity trying to misuse the permissions.

Answer

Condition with aws:SourceArn

Answer

Condition with aws:SourceAccount

Answer

Principal element with the vendor's AWS account ID

Question 3

A company is developing a web application that runs on Amazon EC2 instances. The application needs to access an Amazon DynamoDB table to store and retrieve data. The security team requires that no IAM users or long-lived credentials should be used; instead, the application must use temporary credentials that are automatically rotated. Which approach should the developer use to securely grant access to DynamoDB?

Accepted Answer

Launch the EC2 instance with an instance profile that has an IAM role attached. The IAM role should have a policy granting access to the DynamoDB table. The application uses the AWS SDK to obtain temporary credentials from the instance metadata service.. To resolve the contradiction, the stem should be updated to state that 'no IAM users or long-lived credentials should be used' instead of 'no IAM users or roles'. This aligns with AWS best practices of using IAM roles for EC2 instances to obtain temporary, automatically rotated credentials via the Instance Metadata Service (IMDS).

Answer

Create an IAM user with access keys and store the keys in AWS Secrets Manager. Have the application retrieve the keys at runtime.

Answer

Use an AWS Lambda function to generate a pre-signed URL that allows access to DynamoDB, and have the EC2 instance use that URL.

Answer

Generate a long-lived API token using AWS KMS and embed it in the application code.

Question 4

A developer needs to grant read-only access to objects in an S3 bucket (in Account A) to an IAM role in Account B. The bucket uses server-side encryption with AWS KMS (SSE-KMS) using a customer managed key (CMK) in Account A. Which of the following is REQUIRED for the cross-account access to succeed?

Accepted Answer

The S3 bucket policy in Account A grants s3:GetObject to the IAM role in Account B, the KMS key policy in Account A grants kms:Decrypt to the IAM role in Account B, and the IAM role in Account B has a trust policy allowing the IAM user to assume it.. For cross-account access to S3 objects encrypted with a customer managed KMS key, permissions must be granted in three places: 
1. The S3 bucket policy in Account A must grant `s3:GetObject` to the IAM role in Account B.
2. The KMS key policy in Account A must grant `kms:Decrypt` to the IAM role in Account B (since KMS key policies do not automatically delegate to IAM policies cross-account).
3. The IAM role's identity-based policy in Account B must grant permissions to perform `s3:GetObject` on the bucket and `kms:Decrypt` on the KMS key in Account A.

Answer

The S3 bucket policy in Account A grants s3:GetObject to the IAM role in Account B, and the IAM role in Account B has a trust policy allowing the IAM user to assume it. No KMS key policy is needed because the role can use the key via IAM policies.

Answer

The S3 bucket policy in Account A grants s3:GetObject to the IAM user in Account B, and the IAM user's IAM policy grants s3:GetObject.

Answer

The S3 bucket uses SSE-C, so the developer must provide the encryption key in the request. No KMS key policy is needed.

Question 5

A company stores application logs in an Amazon S3 bucket. The security team requires that all objects uploaded to the bucket must be encrypted at rest using an AWS KMS key. The developer needs to enforce this by denying any PutObject request that does not use the required encryption. Which bucket policy condition should be used?

Accepted Answer

"s3:x-amz-server-side-encryption": "aws:kms". To enforce that all uploaded objects are encrypted using SSE-KMS, you must deny any `s3:PutObject` request that does not have the `s3:x-amz-server-side-encryption` condition set to `aws:kms`. If you wanted to restrict uploads to a *specific* KMS key, you would use `s3:x-amz-server-side-encryption-aws-kms-key-id`, but the requirement here is simply to ensure that an AWS KMS key is used.

Answer

"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc"

Answer

"s3:x-amz-server-side-encryption": "AES256"

Answer

"kms:EncryptionContext": "service:s3"

Question 6

A company runs an application on Amazon EC2 instances that need to read files from an Amazon S3 bucket. The developer must grant access to the S3 bucket without storing long-term credentials on the instances. Which approach should the developer use?

Accepted Answer

Create an IAM role with permissions to the S3 bucket and attach it to the EC2 instance profile.. Using an IAM role attached to an EC2 instance profile allows the application to obtain temporary security credentials from the AWS Security Token Service (STS) via the instance metadata service. This eliminates the need to store long-term credentials on the instance, adhering to the principle of least privilege and improving security posture.

Answer

Store the access key ID and secret access key in environment variables on the EC2 instance.

Answer

Use an S3 bucket policy that grants access to the EC2 instance's public IP address.

Answer

Store the credentials in AWS Secrets Manager and have the application retrieve them at startup.

Question 7

A company needs to grant another AWS account read-only access to an S3 bucket. The developer wants to use a bucket policy without requiring IAM users in the trusted account. Which resource-based policy statement should the developer add to the bucket?

Accepted Answer

A principal of 'arn:aws:iam::OTHER-ACCOUNT-ID:root' with s3:GetObject and s3:ListBucket.. To grant another AWS account access to an S3 bucket, you specify the trusted account's root ARN ('arn:aws:iam::OTHER-ACCOUNT-ID:root') as the Principal. The trusted account's administrator can then delegate these permissions to their IAM users and roles. Note that you cannot use wildcards like 'arn:aws:iam::OTHER-ACCOUNT-ID:*' in the Principal element of an IAM or resource policy; doing so results in an 'Invalid principal in policy' error.

Answer

A principal of the root user of the other account with s3:GetObject.

Answer

A principal of any user with a condition for the account ID.

Answer

A principal of the other account's root ARN with s3:ListBucket and s3:GetObject.

Question 8

A developer is building a REST API using API Gateway and AWS Lambda. The API must only be accessible by authenticated users who belong to a specific group within an Amazon Cognito user pool. Which API Gateway authorization mechanism should the developer use?

Accepted Answer

Lambda authorizer. A Lambda authorizer is the correct choice because API Gateway's native Amazon Cognito User Pool authorizer only validates the token's signature and expiration; it cannot perform group-based authorization. To restrict access to specific groups at the API Gateway level, a Lambda authorizer must be used to decode the incoming JWT, inspect the `cognito:groups` claim, and return an appropriate IAM policy to allow or deny the request.

Answer

AWS IAM authorization

Answer

Amazon Cognito User Pool authorizer

Answer

API key

Question 9

A company wants to enforce that all IAM users use multi-factor authentication (MFA) when accessing the AWS Management Console. Which IAM policy condition key should be used in a policy attached to each user or group to deny access if MFA is not present?

Accepted Answer

aws:MultiFactorAuthPresent. The correct condition key is `aws:MultiFactorAuthPresent`, which is a boolean value that is `true` when the user has authenticated using a valid MFA device. By using this key in a `Deny` effect policy (often combined with `Bool` condition), you can block any API call or console access that does not include MFA authentication. This is the standard AWS approach to enforce MFA for console access.

Answer

aws:RequestedRegion

Answer

aws:SourceIp

Answer

aws:SecureTransport

Question 10

A developer needs to store a database password for an AWS Lambda function. The password must be encrypted at rest with a customer-managed key that can be rotated manually. Which solution meets these requirements with minimal operational overhead?

Accepted Answer

Store the password in AWS Systems Manager Parameter Store as a SecureString parameter. AWS Systems Manager Parameter Store provides secure storage for configuration data and secrets. By using a SecureString parameter, the database password is encrypted at rest using a customer-managed AWS KMS key. This approach has minimal operational overhead because the Lambda function can retrieve the parameter dynamically at runtime, and any manual rotation of the password or the KMS key only needs to be performed in one centralized place without redeploying or modifying the Lambda function configuration.

Answer

Store the password in an encrypted Lambda environment variable using a customer-managed AWS KMS key

Answer

Store the password in AWS Secrets Manager and configure automatic rotation

Answer

Store the password in an Amazon S3 configuration file encrypted with server-side encryption

Question 11

A Lambda function needs to decrypt data encrypted with a customer managed KMS key. Which two permissions are commonly required?

Accepted Answer

kms:Decrypt on the key. To decrypt data, the Lambda function's execution role must be granted the `kms:Decrypt` permission in its IAM policy, and the KMS key policy must permit the role to perform this action. Simplifying this to a single-select question about the IAM execution role permission makes it much cleaner and standard for the AWS Certified Developer Associate exam.

Answer

iam:CreateUser on the account

Answer

s3:PutBucketAcl on every bucket

Answer

Permission for the Lambda execution role to use the KMS key

Question 12

A developer uses API Gateway with Cognito. Which two token validations are important when authorizing API access?

Accepted Answer

Validate issuer and audience/client ID. When authorizing API access using API Gateway and Cognito, two critical validation steps are:
1. Validating the token's issuer (iss) and audience (aud) or client ID (client_id) to ensure the token was issued by the trusted Cognito User Pool and is intended for your specific application (Option A).
2. Validating the scopes (for access tokens) or group claims (for ID tokens) to ensure the caller has the required permissions to access the specific API route (Option C).

Answer

Accept any JWT signed with none algorithm

Answer

Trust only the username string sent in a header

Question 13

A team wants to prevent secrets from being committed to source control and reduce blast radius if a secret is exposed. Which two practices help?

Accepted Answer

Use Secrets Manager or Parameter Store SecureString instead of source code. AWS Secrets Manager and Systems Manager Parameter Store SecureString are purpose-built services for securely storing and managing secrets like database credentials and API keys. By using these services, secrets are never hardcoded in source code, eliminating the risk of accidental exposure through version control. Additionally, rotating secrets regularly limits the validity period of any compromised credential, while applying least-privilege IAM policies ensures that even if a secret is exposed, the attacker's access is restricted to only the necessary resources, thereby minimizing the blast radius.

Answer

Store production secrets in README files

Answer

Give all developers AdministratorAccess

Question 14

Drag and drop the steps to deploy a containerized application using AWS ECS with Fargate in the correct order.

Accepted Answer

Create ECS cluster, then define task definition, then register task definition, then create service. To deploy a containerized application using AWS ECS with Fargate, the standard sequence of steps is:
1. Create an ECS cluster to host your services.
2. Define the task definition (e.g., write the JSON configuration specifying container images, CPU, and memory).
3. Register the task definition with ECS.
4. Create the ECS service within the cluster using the registered task definition.

Answer

Define task definition, then create ECS cluster, then register task definition, then create service

Answer

Define task definition, then register task definition, then create ECS cluster, then create service

Answer

Define task definition, then create ECS cluster, then create service, then register task definition

Question 15

Drag and drop the steps to implement a disaster recovery plan using cross-region replication for S3 in the correct order.

Accepted Answer

Create source and destination S3 buckets, then enable versioning on both buckets, then set up IAM permissions for replication, then configure a replication rule on the source bucket.. First create buckets, enable versioning, configure replication rule, and set permissions.

Answer

Enable versioning on both buckets, then create source and destination S3 buckets, then set up IAM permissions, then configure a replication rule.

Answer

Configure a replication rule on the source bucket, then create source and destination S3 buckets, then enable versioning, then set up IAM permissions.

Answer

Create source and destination S3 buckets, then set up IAM permissions, then configure a replication rule, then enable versioning on both buckets.