DVA-C02 Security Practice Question
A company uses AWS KMS to encrypt data at rest. A developer wants to allow a Lambda function to decrypt data using a KMS key. What is the minimum permissions required?
⚠ Common exam trap
DVA-C02 often tests least privilege, and candidates may choose kms:Encrypt and kms:Decrypt thinking both are needed, but the question specifies only decryption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
kms:Decrypt on the key in the Lambda execution role.
The minimum permission required is kms:Decrypt on the specific key, attached to the Lambda execution role. The Lambda function only needs to decrypt data, not encrypt it, so kms:Decrypt is sufficient. Granting it on the specific key follows the principle of least privilege.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
kms:Decrypt on all keys.
Why it's wrong here
Granting kms:Decrypt with a wildcard resource ('*') violates least privilege by allowing the function to decrypt data under any KMS key in the account, far exceeding what's needed to work with a single specific key, and is not the minimum required scope.
- ✗
kms:Encrypt and kms:Decrypt on the key.
Why it's wrong here
kms:Encrypt is unnecessary for decryption and grants extra capability beyond the task, so it is not minimal. It is tempting because developers often pair Encrypt and Decrypt when configuring round-trip cryptographic access, which would be correct if the Lambda also needed to encrypt data with the same key.
- ✓
kms:Decrypt on the key in the Lambda execution role.
Why this is correct
Attaching a policy statement granting only kms:Decrypt, scoped to the specific key's ARN, on the Lambda execution role is exactly the least-privilege permission needed — it grants decrypt capability for that one key and nothing more.
- ✗
Full access to KMS.
Why it's wrong here
Full KMS access (kms:*) grants key management actions like CreateKey, ScheduleKeyDeletion, and PutKeyPolicy that a function only needing to decrypt data has no legitimate use for, making it a significant over-grant relative to the stated need.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.