Hard — DVA-C02 Practice Quiz

Question 1

A company keeps its CI/CD tooling in a central 'Tools' AWS account. A CodePipeline in this account builds artifacts with CodeBuild and must deploy a CloudFormation stack into a separate 'Production' AWS account. The pipeline's CloudFormation deploy action fails with an access-denied error when it tries to create resources in the Production account. What is the correct way to enable this cross-account deployment?

Accepted Answer

In the Production account, create an IAM role that trusts the Tools account and grants CloudFormation permissions; reference this role in the pipeline's CloudFormation deploy action so it assumes the role, and grant the pipeline's artifact S3 bucket and KMS key cross-account access.

Answer

Copy the CodePipeline service role's access keys into the Production account and configure CloudFormation to use those long-term credentials during stack creation.

Answer

Enable AWS Organizations service control policies that automatically allow any pipeline in the Tools account to deploy CloudFormation stacks in member accounts without additional roles.

Answer

Recreate the entire pipeline inside the Production account so that no cross-account permissions are required, and manually copy build artifacts between accounts.

Question 2

A developer is designing a DynamoDB table that ingests high-volume IoT sensor readings. All devices report using the same 'metric-type' value (temperature), which the team initially chose as the partition key. During load tests, they observe severe write throttling on a single partition even though total provisioned write capacity is far from being fully consumed. Which change to the table design will best distribute the write load?

Accepted Answer

Add a random suffix (e.g., a value from 1–10) to the partition key value to create a write-sharding scheme, and store the original metric-type as a separate attribute.

Answer

Switch the table to on-demand capacity mode so DynamoDB automatically avoids all throttling regardless of key distribution.

Answer

Create a global secondary index on the timestamp attribute so writes are routed to the index instead of the base table.

Answer

Increase the provisioned write capacity units on the table until the throttling stops during the load test.

Question 3

A developer builds a DynamoDB table for an IoT platform that ingests telemetry from thousands of sensors. The table uses 'deviceType' as the partition key and a timestamp as the sort key. Only three device types exist. During load testing, the application experiences frequent ProvisionedThroughputExceededException errors even though total consumed capacity is far below the provisioned capacity. What is the MOST likely cause and the best remediation?

Accepted Answer

The partition key has low cardinality, creating hot partitions; redesign the key to use a high-cardinality value such as 'deviceId' to distribute writes evenly.

Answer

Provisioned capacity is set too low; switch the table to on-demand capacity mode to eliminate all throttling regardless of key design.

Answer

The sort key timestamp causes throttling; remove the sort key and store timestamps as a non-key attribute.

Answer

DynamoDB Streams is consuming write capacity; disable Streams to free up throughput for the ingestion workload.

Question 4

A developer is building a Lambda function that must decrypt data using a customer managed KMS key owned by the same AWS account. The function's execution role has an IAM policy that allows kms:Decrypt on the specific key ARN. However, calls to Decrypt fail with an AccessDeniedException. The KMS key policy contains only the default statement granting the account root full access. What is the MOST likely cause and correct fix?

Accepted Answer

The KMS key policy must explicitly delegate permissions to IAM by including a statement that allows the account principal to use IAM policies; add a statement granting the root principal kms:* so IAM policies take effect, or grant the role directly in the key policy.

Answer

IAM policies cannot grant KMS permissions at all; you must add a grant using the CreateGrant API for the Lambda execution role.

Answer

The Lambda function needs the kms:GenerateDataKey permission instead of kms:Decrypt, because Decrypt is only used for envelope key generation.

Answer

You must enable automatic key rotation on the customer managed key before the execution role can call Decrypt.

Question 5

A developer is building a document-processing service where each customer's files are encrypted with a shared KMS customer managed key. A downstream Lambda function must be able to decrypt only files belonging to a specific tenant, identified by a tenant ID that is passed as encryption context during encryption. The team wants to grant the Lambda's execution role temporary decrypt permission that is scoped so it can only decrypt data encrypted with that tenant's encryption context, without editing the key policy. Which approach meets these requirements?

Accepted Answer

Create a KMS grant for the Lambda execution role that includes a GrantConstraints EncryptionContextEquals condition matching the tenant ID.

Answer

Add an IAM policy to the Lambda execution role allowing kms:Decrypt on the key with no additional conditions.

Answer

Modify the KMS key policy to add a statement allowing the Lambda role to call kms:Decrypt for all encryption contexts.

Answer

Enable automatic key rotation on the customer managed key so each tenant gets a unique backing key version.

Question 6

A developer maintains a document-processing microservice that runs under an IAM role. The service must temporarily allow a short-lived worker process (running under a different IAM role) to encrypt documents using a specific customer managed KMS key, but only for the duration of a single processing job. The security team requires that no changes be made to the KMS key policy and that the delegated permission can be programmatically revoked when the job completes. Which approach best meets these requirements?

Accepted Answer

Create a KMS grant on the key that specifies the worker role as the grantee principal with the Encrypt operation, then call RetireGrant when the job finishes.

Answer

Add a statement to the KMS key policy granting the worker role kms:Encrypt, then remove the statement after the job completes.

Answer

Attach an identity-based IAM policy to the worker role granting kms:Encrypt on the key, then detach the policy when the job completes.

Answer

Use STS AssumeRole so the worker assumes the document-processing service role, inheriting its KMS permissions for the job.

Question 7

A developer builds a Lambda function that must decrypt objects using a specific customer managed KMS key in the same account. The function's execution role already has an identity-based policy granting kms:Decrypt on that key ARN. However, invocations fail with an AccessDeniedException when calling Decrypt. The KMS key's key policy contains only the default statement granting the root account 'kms:*' but no other statements. What is the MOST likely cause and the correct fix?

Accepted Answer

The default 'kms:*' to root only enables IAM policies to grant access; verify the execution role's policy is attached and the key ARN/region match, since the default policy already allows IAM-based delegation.

Answer

The default key policy with root 'kms:*' delegates permission management to IAM, so the failure is unrelated to KMS; the fix is to add a resource-based bucket policy allowing decrypt.

Answer

The default key policy delegates access control to IAM policies for that account, so the IAM role's kms:Decrypt permission should already work; the real cause is a missing kms:GenerateDataKey permission that must be added to the role.

Answer

A key policy statement explicitly granting the Lambda execution role kms:Decrypt is always mandatory even when the default root statement exists; add a key policy statement naming the role as principal.

Question 8

A developer configures an AWS Lambda function with a DynamoDB Streams event source mapping to process changes to an orders table. During load testing, the team notices that updates to the same order item are occasionally processed out of order, causing incorrect final states. The function is configured with a batch size of 100 and a parallelization factor of 10. What is the MOST likely cause and the correct fix?

Accepted Answer

The parallelization factor greater than 1 allows multiple concurrent batches per shard, breaking per-item ordering; set the parallelization factor to 1 to preserve ordering within a partition key.

Answer

The batch size of 100 is too large; reduce the batch size to 1 so each record is processed individually and ordering is guaranteed.

Answer

DynamoDB Streams does not guarantee any ordering; add a FIFO SQS queue between the stream and Lambda to enforce ordering.

Answer

The Lambda function's reserved concurrency is too low; increase reserved concurrency so records are not throttled and reordered.

Question 9

A company stores a third-party API key in AWS Secrets Manager in Account A (the security account). A Lambda function running in Account B (the workloads account) must retrieve this secret at runtime. The secret is encrypted with a customer managed KMS key in Account A. What combination of configurations is required to allow the Lambda function to read the secret?

Accepted Answer

Attach a resource-based policy to the secret granting the Account B Lambda role access, grant that role decrypt permission on the KMS key via the key policy, and give the Lambda role identity-based GetSecretValue and kms:Decrypt permissions.

Answer

Enable automatic rotation on the secret so it becomes readable across all accounts in the AWS Organization.

Answer

Copy the secret value into an environment variable of the Lambda function in Account B so no cross-account calls are needed.

Answer

Attach only an identity-based policy to the Lambda role in Account B; Secrets Manager automatically trusts any IAM principal with GetSecretValue permission across accounts.

Question 10

A developer configures an AWS Lambda function to process messages from a standard Amazon SQS queue using an event source mapping. The Lambda function normally completes in about 45 seconds, but during peak traffic some invocations take up to 90 seconds. Customers report that the same order is occasionally processed more than once. What is the MOST likely cause and the correct fix?

Accepted Answer

The SQS queue visibility timeout is shorter than the Lambda function's maximum execution time, so messages become visible again and are redelivered; increase the visibility timeout to at least the function timeout.

Answer

The Lambda reserved concurrency is too low, causing throttling; increase reserved concurrency so all messages are processed once.

Answer

The SQS queue is FIFO but the message group ID is not set; switch to a standard queue to guarantee exactly-once delivery.

Answer

The Lambda function memory is too low, causing timeouts; increase memory so the function always completes before the batch window closes.

Question 11

A SaaS monitoring company needs to access resources in your AWS account to collect CloudWatch metrics. Your security team wants to grant the third party cross-account access via an IAM role while preventing the 'confused deputy' problem, where another of the vendor's customers could trick the vendor into accessing your account. What should you configure on the role's trust policy?

Accepted Answer

Add a Condition that requires the vendor to pass a unique ExternalId value when calling sts:AssumeRole

Answer

Attach an identity-based policy to the vendor's IAM user granting sts:AssumeRole on your role

Answer

Enable MFA on the vendor's account and require aws:MultiFactorAuthPresent in the trust policy

Answer

Restrict the trust policy to the vendor's account ID only, without any additional conditions