20+ practice questions focused on Security — one of the most tested topics on the AWS Certified Developer Associate DVA-C02 exam. Each question includes a detailed explanation so you learn why the right answer is correct.
Start Security PracticeA company has an AWS Lambda function that processes sensitive financial data. The function uses environment variables to store database connection strings. A security audit requires that all sensitive data be encrypted at rest and in transit. The developer must ensure that the environment variables are encrypted with a customer-managed key that is rotated quarterly. What should the developer do?
Explanation: To resolve this contradiction, the stem has been updated to focus on securing and rotating the database credentials currently stored in the environment variables. AWS Secrets Manager is the best practice for storing, encrypting with a customer-managed KMS key, and automatically rotating database credentials every 90 days (quarterly).
A company wants to grant a third-party vendor access to an Amazon S3 bucket in the company's AWS account. The vendor has their own AWS account. The company requires the vendor to include a unique identifier in each request to verify their identity before granting access. Which policy element should the company include in the S3 bucket policy?
Explanation: The `sts:ExternalId` condition key is specifically designed for scenarios where a third party (the vendor) needs to access AWS resources in your account, and you want to ensure that the vendor includes a unique identifier in each request. This prevents the confused deputy problem by requiring the vendor to pass the external ID in the `AssumeRole` call. By including this condition in the IAM role's trust policy, the company can verify that the request originates from the intended vendor and not from another entity trying to misuse the permissions.
A company is developing a web application that runs on Amazon EC2 instances. The application needs to access an Amazon DynamoDB table to store and retrieve data. The security team requires that no IAM users or long-lived credentials should be used; instead, the application must use temporary credentials that are automatically rotated. Which approach should the developer use to securely grant access to DynamoDB?
Explanation: To resolve the contradiction, the stem should be updated to state that 'no IAM users or long-lived credentials should be used' instead of 'no IAM users or roles'. This aligns with AWS best practices of using IAM roles for EC2 instances to obtain temporary, automatically rotated credentials via the Instance Metadata Service (IMDS).
A developer needs to grant read-only access to objects in an S3 bucket (in Account A) to an IAM role in Account B. The bucket uses server-side encryption with AWS KMS (SSE-KMS) using a customer managed key (CMK) in Account A. Which of the following is REQUIRED for the cross-account access to succeed?
Explanation: For cross-account access to S3 objects encrypted with a customer managed KMS key, permissions must be granted in three places: 1. The S3 bucket policy in Account A must grant `s3:GetObject` to the IAM role in Account B. 2. The KMS key policy in Account A must grant `kms:Decrypt` to the IAM role in Account B (since KMS key policies do not automatically delegate to IAM policies cross-account). 3. The IAM role's identity-based policy in Account B must grant permissions to perform `s3:GetObject` on the bucket and `kms:Decrypt` on the KMS key in Account A.
A company stores application logs in an Amazon S3 bucket. The security team requires that all objects uploaded to the bucket must be encrypted at rest using an AWS KMS key. The developer needs to enforce this by denying any PutObject request that does not use the required encryption. Which bucket policy condition should be used?
Explanation: To enforce that all uploaded objects are encrypted using SSE-KMS, you must deny any `s3:PutObject` request that does not have the `s3:x-amz-server-side-encryption` condition set to `aws:kms`. If you wanted to restrict uploads to a *specific* KMS key, you would use `s3:x-amz-server-side-encryption-aws-kms-key-id`, but the requirement here is simply to ensure that an AWS KMS key is used.
+15 more Security questions available
Practice all Security questions1. Baseline your knowledge
Start with 10 questions to gauge your current understanding of Security. This tells you whether you need a concept refresher or just practice.
2. Review every explanation
For each question — right or wrong — read the full explanation. Understanding why an answer is correct is more valuable than knowing the answer itself.
3. Focus on exam traps
Security questions on the DVA-C02 frequently use trap wording. Look for subtle differences in answers that test your precision, not just general knowledge.
4. Reach 80% consistently
Do repeated sessions until you score 80%+ three times in a row. Then move to mixed-mode practice to test cross-topic recall under realistic conditions.
The exact number varies per candidate. Security is tested as part of the AWS Certified Developer Associate DVA-C02 blueprint. Practicing with targeted Security questions ensures you can handle any format or difficulty that appears.
Yes. Courseiva provides free DVA-C02 practice questions across all exam topics and domains. The platform includes topic-based practice, mock exams, missed-question review, bookmarked questions, and readiness tracking — no account required.
Difficulty is subjective, but Security is a high-priority exam concept tested in multiple ways — direct recall, scenario analysis, and command-output interpretation. Consistent practice is the best way to build confidence.
Launch a full Security practice session with instant scoring and detailed explanations.
Start Security Practice →