DVA-C02 Security — Timed 15 Questions

Question 1

A developer has an AWS Lambda function that needs to read objects from an S3 bucket in another account. The Lambda function's execution role includes an IAM policy that allows s3:GetObject on the bucket. The bucket owner has added a bucket policy that grants s3:GetObject to the Lambda execution role. However, the Lambda function receives Access Denied errors. The S3 bucket uses SSE-KMS for encryption. What is the most likely cause?

Accepted Answer

The Lambda function does not have kms:Decrypt permission on the KMS key used by the bucket.. When an S3 bucket uses SSE-KMS, the Lambda function must have explicit kms:Decrypt permission on the KMS key to decrypt the object after s3:GetObject retrieves the encrypted data. Even though the bucket policy and execution role allow s3:GetObject, the missing KMS permission causes an Access Denied error because S3 returns the encrypted object and the Lambda runtime cannot decrypt it without the key.

Answer

The S3 bucket does not have versioning enabled.

Answer

The Lambda function's execution role does not have an explicit allow for s3:GetObject.

Answer

The Lambda function is not in the same AWS region as the S3 bucket.

Question 2

A company has multiple AWS accounts managed under AWS Organizations. The security team requires that all Amazon S3 buckets with bucket names containing 'logs' must be encrypted with a specific KMS key (key ID: alias/logs-key) at rest. A developer must enforce this using an SCP (Service Control Policy). Which SCP effect and condition key should be used to deny any PutObject request that does not use the required KMS key?

Accepted Answer

Deny effect with a Condition: StringNotEquals on s3:x-amz-server-side-encryption-aws-kms-key-id. Option A is correct because SCPs use a Deny effect to block non-compliant requests. The condition key `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` ensures that any PutObject request that does not specify the exact KMS key alias/logs-key is denied. This enforces encryption with the required key for all S3 buckets containing 'logs' in their name.

Answer

Deny effect with a Condition: StringEquals on s3:x-amz-server-side-encryption

Answer

Allow effect with a Condition: StringEquals on kms:RequestTag/key-id

Answer

Deny effect with a Condition: IpAddress on aws:SourceIp

Question 3

A developer needs to grant a user in another AWS account (Account B) read-only access to objects in an Amazon S3 bucket owned by Account A. The developer has already added a bucket policy that grants s3:GetObject access to the IAM user in Account B. However, the user in Account B still gets Access Denied when trying to read objects. What additional configuration is required?

Accepted Answer

The user in Account B must have an IAM policy that allows s3:GetObject on the bucket ARN. The bucket policy in Account A grants s3:GetObject access to the IAM user in Account B, but this alone is insufficient. For cross-account access, the IAM user in Account B must also have an IAM policy attached that explicitly allows s3:GetObject on the bucket ARN. Without this, the user’s own account denies the request before it reaches Account A’s bucket policy, resulting in Access Denied.

Answer

The bucket must be made public by unchecking 'Block all public access'

Answer

The developer must create a new IAM role in Account A and have the user in Account B assume that role

Answer

The user in Account B must use the S3 console instead of the AWS CLI

Question 4

A developer needs to ensure that every cryptographic operation performed on an AWS KMS customer master key (CMK) used for server-side encryption in Amazon S3 is recorded in AWS CloudTrail for auditing. The developer has already enabled CloudTrail and is logging management events. However, the security team wants to see all calls to the KMS Decrypt and Encrypt APIs for this specific key. What must the developer do?

Accepted Answer

Enable CloudTrail data events for the specific KMS key ARN.. Option C is correct because CloudTrail data events can be configured to log individual API operations (such as Decrypt and Encrypt) on specific KMS keys. By default, CloudTrail management events do not include these data-plane operations; enabling data events for the specific KMS key ARN ensures every cryptographic call is recorded for auditing.

Answer

Enable CloudTrail data events for the S3 bucket containing the encrypted objects.

Answer

Create an additional CloudTrail trail that logs all management events for the KMS key.

Answer

Enable CloudTrail Insights events on the existing trail.

Question 5

A developer is building a mobile application that uses Amazon Cognito for user authentication. After a user signs in, the application needs to access an Amazon DynamoDB table. The developer has set up an identity pool with an authenticated role. The IAM role attached to the authenticated identity has a policy allowing the required DynamoDB actions. However, users report that they cannot perform DynamoDB operations. What is the MOST likely cause of this issue?

Accepted Answer

The IAM role's trust policy does not allow Cognito to assume it.. The most likely cause is that the IAM role's trust policy does not include a statement allowing Amazon Cognito (specifically the `cognito-identity.amazonaws.com` service principal) to assume the role. Even if the identity pool is configured to use the authenticated role and the role's permissions policy grants DynamoDB actions, Cognito must be able to assume the role via AWS Security Token Service (STS) `AssumeRoleWithWebIdentity`. Without the correct trust relationship, Cognito cannot obtain temporary credentials for the user, so all DynamoDB operations fail.

Answer

The identity pool is not configured to use the authenticated role.

Answer

The app is not passing the correct identity ID.

Answer

The DynamoDB table is encrypted with a different KMS key.

Question 6

A company uses a customer managed AWS KMS key to encrypt sensitive data stored in DynamoDB. A Lambda function reads from the DynamoDB table and needs to decrypt the data. The Lambda function's execution role has an IAM policy that allows kms:Decrypt on the key. However, access is denied. What must the developer add to the KMS key policy to resolve the issue?

Accepted Answer

Add a statement granting kms:Decrypt to the Lambda function's execution role.. The correct answer is A because KMS key policies are resource-based policies that control access to the key itself. Even if the Lambda execution role has an IAM policy granting kms:Decrypt, the KMS key policy must explicitly allow the role (or the user/account) to perform that action. Without this statement in the key policy, the IAM permission is ineffective, resulting in an access denied error.

Answer

Add a statement granting kms:Decrypt to the Lambda function's resource-based policy.

Answer

Add a statement granting kms:Decrypt to the Lambda service principal.

Answer

Add a statement granting kms:Decrypt to the account root user with a condition for the Lambda function.

Question 7

A company has an AWS Lambda function that processes sensitive financial data. The function uses environment variables to store database connection strings. A security audit requires that all sensitive data be encrypted at rest and in transit. The developer must ensure that the environment variables are encrypted with a customer-managed key that is rotated quarterly. What should the developer do?

Accepted Answer

Store the connection string in AWS Secrets Manager and enable automatic rotation with a custom Lambda function. Option B is correct because AWS Secrets Manager natively supports automatic rotation of secrets using a custom Lambda function, which meets the quarterly rotation requirement. Secrets Manager also encrypts secrets at rest using KMS, and the customer can specify a customer-managed key (CMK) for encryption, satisfying the encryption-at-rest and customer-managed key requirements. Additionally, Secrets Manager enforces encryption in transit via TLS when retrieving secrets, fulfilling the full security audit mandate.

Answer

Use AWS Systems Manager Parameter Store with a SecureString parameter using an AWS managed key

Answer

Encrypt the environment variables using the Lambda service key

Answer

Use AWS KMS to encrypt the environment variables and set a manual rotation policy

Question 8

A company has an Amazon S3 bucket (Bucket-A) in Account A that contains sensitive data. A developer in Account B needs read-only access to objects in Bucket-A. The developer in Account A added a bucket policy granting s3:GetObject to the IAM user in Account B. However, the IAM user in Account B still receives Access Denied errors. What additional step is required?

Accepted Answer

Create an IAM policy in Account B that allows s3:GetObject for the specific bucket and attach it to the user. The bucket policy in Account A grants access to the IAM user in Account B, but the user's identity in Account B must also have an explicit IAM policy that allows the s3:GetObject action. Without this, the user in Account B lacks the necessary permissions to access the bucket, even though the bucket policy permits it. This is because cross-account access requires both a resource-based policy (bucket policy) in the source account and an identity-based policy (IAM policy) in the target account to authorize the request.

Answer

Add an S3 bucket ACL granting the user in Account B Read access

Answer

Generate a pre-signed URL for each object and share it with the user

Answer

Add a condition in the bucket policy to allow requests only from the user's IP address

Question 9

A company uses an Amazon S3 bucket to store sensitive documents. The security team requires that all objects uploaded to the bucket must be encrypted at rest using server-side encryption with a customer-managed KMS key (SSE-KMS). A developer needs to enforce this by denying any PutObject request that does not specify the required encryption. Which bucket policy condition should be used?

Accepted Answer

"Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}. Option A is correct because the condition `s3:x-amz-server-side-encryption-aws-kms-key-id` with `StringNotEquals` explicitly denies any PutObject request that does not specify the exact customer-managed KMS key ARN. This enforces SSE-KMS with a specific key, meeting the security team's requirement that all objects must be encrypted at rest using that key.

Answer

"Condition": {"StringNotEquals": {"s3:x-amz-server-side-encryption": "aws:kms"}}

Answer

"Condition": {"Null": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "true"}}

Answer

"Condition": {"ArnNotEquals": {"s3:x-amz-server-side-encryption-aws-kms-key-id": "arn:aws:kms:us-east-1:123456789012:key/abc123"}}

Question 10

A company stores sensitive data in Amazon S3. The security team requires that all objects are encrypted at rest using server-side encryption with AWS KMS managed keys (SSE-KMS). The developer needs to enforce that any PutObject request that does not specify the 'x-amz-server-side-encryption' header with value 'aws:kms' is denied. Which S3 bucket policy condition should be used?

Accepted Answer

s3:x-amz-server-side-encryption equals 'aws:kms'. Option A is correct because the condition key `s3:x-amz-server-side-encryption` in an S3 bucket policy can be used to require that the `x-amz-server-side-encryption` header is set to `aws:kms` on every PutObject request. This enforces server-side encryption with AWS KMS (SSE-KMS) at the bucket policy level, denying any request that omits or uses a different encryption header value.

Answer

s3:x-amz-server-side-encryption-aws-kms-key-id equals the KMS key ARN

Answer

s3:x-amz-acl equals 'bucket-owner-full-control'

Answer

s3:signatureversion equals 'AWS4-HMAC-SHA256'

Question 11

A developer in Account A has an Amazon S3 bucket that contains sensitive data. The developer wants to grant an IAM user in Account B read-only access to objects in the bucket. The developer has added a bucket policy in Account A that grants s3:GetObject access to the IAM user's ARN. However, the IAM user in Account B still receives Access Denied errors. What additional configuration is required?

Accepted Answer

Add an IAM policy in Account B that allows the user to perform s3:GetObject on the bucket's ARN.. Option A is correct because cross-account access to S3 requires both a bucket policy in the source account (Account A) granting the necessary permissions to the target IAM user, and an IAM identity-based policy in the target account (Account B) that explicitly allows the same action (s3:GetObject) on the bucket's ARN. Without the IAM policy in Account B, the user lacks the authorization to initiate the request, even though the bucket policy permits it. This dual-permission model is a fundamental security requirement for cross-account S3 access.

Answer

Create an S3 access point and grant the user access through it.

Answer

Change the bucket policy to grant access to the entire AWS account B instead of the specific user.

Answer

Enable S3 object ownership and set the bucket ACL to grant read access to the user in Account B.

Question 12

A company runs an application on Amazon EC2 that needs to securely store database credentials. The security team requires that credentials be automatically rotated every 30 days to reduce the risk of compromise. The application must be able to retrieve the credentials at startup without storing them in code or configuration files. Which AWS service should the developer use?

Accepted Answer

AWS Secrets Manager. AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule (e.g., every 30 days) without requiring custom code. The application can retrieve credentials at startup via the Secrets Manager API using IAM permissions, eliminating the need to store secrets in code or configuration files. Secrets Manager natively supports automatic rotation for Amazon RDS, Redshift, and DocumentDB, and can be extended to other services via custom Lambda functions.

Answer

AWS Systems Manager Parameter Store (SecureString)

Answer

AWS Key Management Service (KMS)

Answer

AWS Identity and Access Management (IAM) roles

Question 13

A company wants to grant a third-party vendor access to an Amazon S3 bucket in the company's AWS account. The vendor has their own AWS account. The company requires the vendor to include a unique identifier in each request to verify their identity before granting access. Which policy element should the company include in the S3 bucket policy?

Accepted Answer

Condition with sts:ExternalId. The `sts:ExternalId` condition key is specifically designed for scenarios where a third party (the vendor) needs to access AWS resources in your account, and you want to ensure that the vendor includes a unique identifier in each request. This prevents the confused deputy problem by requiring the vendor to pass the external ID in the `AssumeRole` call or directly in the request to S3 when using role-based access. By including this condition in the bucket policy, the company can verify that the request originates from the intended vendor and not from another entity trying to misuse the permissions.

Answer

Condition with aws:SourceArn

Answer

Condition with aws:SourceAccount

Answer

Principal element with the vendor's AWS account ID

Question 14

A company is developing a web application that runs on Amazon EC2 instances. The application needs to access an Amazon DynamoDB table to store and retrieve data. The security team requires that no IAM users or roles should be used; instead, the application must use temporary credentials that are automatically rotated. Which approach should the developer use to securely grant access to DynamoDB?

Accepted Answer

Launch the EC2 instance with an instance profile that has an IAM role attached. The IAM role should have a policy granting access to the DynamoDB table. The application uses the AWS SDK to obtain temporary credentials from the instance metadata service.. Option B is correct because it uses an IAM role attached to the EC2 instance via an instance profile, which allows the AWS SDK to automatically retrieve temporary credentials from the EC2 instance metadata service (IMDS). These credentials are rotated automatically by AWS, satisfying the security team's requirement for no long-lived IAM users or roles and ensuring secure, temporary access to DynamoDB.

Answer

Create an IAM user with access keys and store the keys in AWS Secrets Manager. Have the application retrieve the keys at runtime.

Answer

Use an AWS Lambda function to generate a pre-signed URL that allows access to DynamoDB, and have the EC2 instance use that URL.

Answer

Generate a long-lived API token using AWS KMS and embed it in the application code.

Question 15

A company uses AWS Secrets Manager to store database credentials. The credentials must be automatically rotated every 30 days. The developer needs to configure rotation without exposing the secret to any IAM user directly. Which configuration steps should the developer take?

Accepted Answer

Create a Lambda function with rotation logic, attach an IAM role with permissions to read and update the secret, and configure Secrets Manager to invoke the function every 30 days.. Option B is correct because AWS Secrets Manager does not provide a built-in Lambda function for rotating database credentials; you must create your own Lambda function that contains the rotation logic (e.g., querying the database, creating a new credential, and updating the secret). The Lambda function must be attached to an IAM role with permissions to read and update the secret, and Secrets Manager invokes this function based on the rotation schedule (every 30 days). This ensures the secret is never exposed directly to any IAM user, as only the Lambda function interacts with the secret programmatically.

Answer

Enable automatic rotation and choose a rotation interval of 30 days. Secrets Manager will automatically rotate the secret using a built-in Lambda function.

Answer

Use AWS Certificate Manager (ACM) to rotate the secret automatically every 30 days.

Answer

Store the secret in AWS Systems Manager Parameter Store and set a schedule to rotate it using a CloudWatch Events rule.