Security — DVA-C02 Practice Quiz

Question 1

A developer is deploying a customer-facing web application behind an Application Load Balancer (ALB). The security team requires that all traffic between clients and the application be encrypted in transit using TLS, and that the TLS certificate be automatically renewed before expiration to avoid outages. The developer wants the least amount of operational overhead. What should the developer do?

Accepted Answer

Request a public certificate from AWS Certificate Manager (ACM) and associate it with an HTTPS listener on the ALB.

Answer

Purchase a certificate from a third-party CA, store the private key in AWS Secrets Manager, and manually attach it to the ALB each year.

Answer

Enable server-side encryption with SSE-KMS on the ALB target group to encrypt traffic to the backend instances.

Answer

Generate a self-signed certificate on each EC2 instance and configure the ALB to forward TLS traffic without termination.

Question 2

A photo-sharing mobile app uses an Amazon Cognito identity pool to grant users temporary AWS credentials so they can upload images directly to an S3 bucket. Each user must be able to read and write ONLY objects under a prefix that matches their own Cognito identity ID (for example, private/${cognito-identity.amazonaws.com:sub}/). The developer wants to enforce this isolation without creating a separate IAM role per user. What is the MOST appropriate way to implement this?

Accepted Answer

Add IAM policy variables such as ${cognito-identity.amazonaws.com:sub} to the resource ARNs in the authenticated role's policy so each user is scoped to their own S3 prefix.

Answer

Generate a distinct pre-signed URL for every upload and download so the app never needs IAM permissions on S3.

Answer

Create a Cognito user pool group for each user and map each group to a dedicated IAM role that restricts access to that user's prefix.

Answer

Attach an S3 bucket policy that grants s3:GetObject and s3:PutObject to the identity pool's authenticated role for the entire bucket.

Question 3

A mobile app authenticates users through an Amazon Cognito user pool. After sign-in, the app must let each authenticated user upload files directly to Amazon S3, but only to a folder prefix matching that user's identity. The developer wants users to receive temporary, scoped AWS credentials without embedding any long-term IAM access keys in the app. Which approach meets these requirements?

Accepted Answer

Exchange the user pool JWT ID token for AWS credentials using a Cognito identity pool with an authenticated IAM role that scopes S3 access using policy variables like ${cognito-identity.amazonaws.com:sub}.

Answer

Distribute an IAM user access key and secret key in the app configuration and restrict the IAM policy to the S3 bucket.

Answer

Call AWS STS GetSessionToken directly from the app using the user's Cognito username and password to obtain temporary credentials.

Answer

Store the credentials in AWS Secrets Manager and have the app fetch them at runtime using the user pool access token.

Question 4

A mobile photo-sharing app lets visitors browse public galleries stored in an Amazon S3 bucket before they sign up. Once users create an account, they can upload their own photos. The developer wants browsing visitors to read the public bucket without any login, while requiring a signed-in identity to upload. Which approach correctly grants the appropriate AWS permissions to each user type?

Accepted Answer

Configure an Amazon Cognito identity pool with both authenticated and unauthenticated roles, mapping guests to a read-only IAM role and signed-in users to a role allowing uploads.

Answer

Embed long-lived IAM access keys with read-only permissions in the app for guests, and generate new keys server-side after users sign in.

Answer

Create a Cognito user pool and grant unauthenticated visitors a JWT access token scoped to read-only S3 access.

Answer

Make the S3 bucket fully public for reads and use a bucket policy that requires SigV4-signed requests for uploads from any client.

Question 5

A developer is building a mobile app that uses an Amazon Cognito user pool for authentication. A user reports they cannot sign in because their account is stuck in the FORCE_CHANGE_PASSWORD state after being created by an administrator. The developer needs to programmatically confirm the user with a permanent password so the user can immediately sign in without being prompted to change it. Which action should the developer take?

Accepted Answer

Call the AdminSetUserPassword API with Permanent set to true.

Answer

Call the ForgotPassword API to trigger a password reset email.

Answer

Call the AdminSetUserPassword API with Permanent set to false.

Answer

Delete and recreate the user with the AdminCreateUser API and MessageAction set to SUPPRESS.

Question 6

A developer is building a confidential server-side web application (running on a backend host) that authenticates users through an Amazon Cognito user pool using the OAuth 2.0 authorization code grant. During setup, the developer must decide how to configure the Cognito app client so that token exchange requests from the backend are properly authenticated. Which configuration is the MOST appropriate for this backend application?

Accepted Answer

Create the app client with a generated client secret and include the secret when the backend exchanges the authorization code for tokens.

Answer

Create the app client without a client secret because Cognito app clients never support secrets.

Answer

Embed the client secret in the browser-side JavaScript so the user's browser can call the token endpoint directly.

Answer

Disable the authorization code grant and use the implicit grant so no secret is required.

Question 7

A developer is building a document management web app that authenticates users with an Amazon Cognito user pool. Users belong to either an 'editors' or 'viewers' group in the user pool. After authentication, the app uses an identity pool to obtain temporary AWS credentials so users can access an S3 bucket directly. Editors must be able to upload objects, while viewers must only be able to read objects. What is the most effective way to enforce these different permission levels?

Accepted Answer

Assign a distinct IAM role to each Cognito user pool group and configure the identity pool to use role-based access control so the credentials returned match the user's group.

Answer

Store the user's group in a JWT custom claim and have the frontend JavaScript decide whether to call the upload or download S3 API.

Answer

Create a single IAM role for all authenticated users that grants both s3:GetObject and s3:PutObject, then filter access in the application code.

Answer

Attach an S3 bucket policy that grants s3:PutObject to the user pool ID and s3:GetObject to the identity pool ID.

Question 8

A developer builds a single-page application (SPA) that must let users sign in and then call a custom REST API secured behind Amazon API Gateway. The team uses an Amazon Cognito user pool with the hosted UI and defines a resource server with custom scopes (for example, orders/read and orders/write). The developer must ensure the SPA receives a token that carries the granted OAuth 2.0 scopes so that API Gateway can authorize access to specific API operations. Which token issued by Cognito should the application send to API Gateway for scope-based authorization?

Accepted Answer

The access token, because it contains the scope claim reflecting the authorized custom scopes.

Answer

The ID token, because it identifies the user and includes all custom scopes in its claims.

Answer

The refresh token, because it can be exchanged directly at API Gateway for scoped permissions.

Answer

A temporary AWS credentials set from a Cognito identity pool, because scopes map to IAM policies.

Question 9

A developer is building a serverless REST API using Amazon API Gateway backed by AWS Lambda. Users sign in through an Amazon Cognito user pool, and the mobile app receives tokens after successful authentication. The API must reject any request that does not carry a valid, non-expired user identity, and the solution should require minimal custom code. Which approach should the developer implement?

Accepted Answer

Configure a Cognito user pool authorizer on API Gateway and have the client send the ID token in the Authorization header.

Answer

Pass the Cognito access token to the Lambda function and call GetUser on the Cognito Identity Provider API inside the handler to validate it.

Answer

Use a Cognito identity pool to exchange the user's credentials for temporary IAM credentials and sign each API request with SigV4.

Answer

Store the user's refresh token in the request body and validate it against Secrets Manager before invoking the Lambda function.

Question 10

A developer builds a mobile app that authenticates users with an Amazon Cognito user pool. The app receives ID, access, and refresh tokens after login. Users complain that they are forced to log in again every hour, which harms the user experience. The developer wants users to stay signed in for up to 30 days without re-entering credentials, while keeping short-lived access tokens for API calls. What is the correct approach?

Accepted Answer

Keep the default 1-hour access token expiration and use the refresh token (with its validity set to 30 days) to obtain new access and ID tokens.

Answer

Increase the access token and ID token validity to 30 days in the user pool app client settings.

Answer

Store the user's password in the device keychain and silently re-authenticate with the InitiateAuth USER_PASSWORD_AUTH flow every hour.

Answer

Configure an identity pool to issue temporary AWS credentials that last 30 days so the app never needs new Cognito tokens.

Question 11

A developer is building a mobile app that requires users to sign up and sign in with an email and password. After authentication, the app must call a backend API and also let users upload files directly to an Amazon S3 bucket using temporary AWS credentials scoped to their identity. Which combination of Amazon Cognito features correctly satisfies both requirements?

Accepted Answer

Use a Cognito user pool to handle sign-up and sign-in, then pass the user pool tokens to a Cognito identity pool to exchange them for temporary AWS credentials for S3 access.

Answer

Use a Cognito identity pool for both user sign-up/sign-in and issuing temporary AWS credentials for S3 access.

Answer

Use a Cognito user pool for sign-up/sign-in and generate long-term IAM access keys per user for S3 access.

Answer

Use a Cognito user pool for sign-up/sign-in and have the app call S3 directly with the user pool ID token as the AWS credential.

Question 12

A developer builds a Lambda function in Account A that must read objects from an S3 bucket owned by Account B. The Lambda execution role already has an identity-based policy allowing s3:GetObject on the target bucket ARN. However, calls still fail with AccessDenied. The bucket is not using default encryption or ACL restrictions. What must the developer do to grant access following AWS cross-account best practices?

Accepted Answer

Add a bucket policy (resource-based policy) in Account B that allows the Account A Lambda role principal to perform s3:GetObject on the bucket.

Answer

Attach an additional identity-based policy with a Deny override removed to the Lambda role in Account A.

Answer

Enable S3 Block Public Access in Account B and make the objects public-read.

Answer

Recreate the Lambda function in Account B so it and the bucket share the same account.

Question 13

A developer is building an application that runs on an on-premises server (not in AWS) and needs to call the Amazon S3 API. The security team prohibits storing long-lived IAM access keys anywhere on the server. Which approach provides temporary AWS credentials to the application while meeting this requirement?

Accepted Answer

Use IAM Roles Anywhere with an X.509 certificate from a trusted certificate authority to obtain temporary credentials via AWS STS.

Answer

Create an IAM user with programmatic access and store the access key ID and secret in a local encrypted file that the application reads at startup.

Answer

Attach an IAM role to the on-premises server the same way you would attach an instance profile to an EC2 instance.

Answer

Embed an IAM access key in the application code and rotate it manually every 90 days using Secrets Manager.

Question 14

A developer builds a Java application that runs on an EC2 instance and needs to read objects from an Amazon S3 bucket. During development, the code used long-term IAM user access keys stored in a properties file. Before deploying to production, the developer must eliminate the hardcoded credentials while granting the application least-privilege S3 read access. What is the recommended approach?

Accepted Answer

Attach an IAM role with an S3 read-only policy to the EC2 instance via an instance profile, and let the AWS SDK retrieve temporary credentials automatically.

Answer

Store the IAM user access keys in AWS Secrets Manager and have the application fetch them at startup using the Secrets Manager SDK.

Answer

Encrypt the properties file containing the access keys with a KMS customer managed key and decrypt it at runtime.

Answer

Set the access key ID and secret access key as EC2 user data so they are injected into the environment at boot time.

Question 15

A developer is building a Lambda function that must decrypt data using a customer managed KMS key owned by the same AWS account. The function's execution role has an IAM policy that allows kms:Decrypt on the specific key ARN. However, calls to Decrypt fail with an AccessDeniedException. The KMS key policy contains only the default statement granting the account root full access. What is the MOST likely cause and correct fix?

Accepted Answer

The KMS key policy must explicitly delegate permissions to IAM by including a statement that allows the account principal to use IAM policies; add a statement granting the root principal kms:* so IAM policies take effect, or grant the role directly in the key policy.

Answer

IAM policies cannot grant KMS permissions at all; you must add a grant using the CreateGrant API for the Lambda execution role.

Answer

The Lambda function needs the kms:GenerateDataKey permission instead of kms:Decrypt, because Decrypt is only used for envelope key generation.

Answer

You must enable automatic key rotation on the customer managed key before the execution role can call Decrypt.

Question 16

A developer is building a document management service that encrypts tenant files using AWS KMS. Each file belongs to a specific tenant, and the security team requires that a decryption request must fail if it does not specify the same tenant identifier that was used at encryption time, without creating a separate KMS key per tenant. Which approach satisfies this requirement?

Accepted Answer

Pass an encryption context containing the tenant ID in both the Encrypt and Decrypt calls so KMS validates it as additional authenticated data.

Answer

Create a KMS grant for each tenant that limits which principal can call Decrypt.

Answer

Store the tenant ID in the object metadata and validate it in application code before calling Decrypt.

Answer

Add a condition on the key policy that checks the tenant ID for every Decrypt request.

Question 17

A developer builds a Lambda function that stores encrypted customer records in DynamoDB using envelope encryption. When writing, the function calls KMS GenerateDataKey to get a plaintext data key and an encrypted data key, encrypts the record locally with the plaintext key, and stores both the ciphertext and the encrypted data key in DynamoDB. To later read a record, what must the function do to recover the plaintext?

Accepted Answer

Call KMS Decrypt with the stored encrypted data key to obtain the plaintext data key, then use it to decrypt the record ciphertext locally.

Answer

Call KMS GenerateDataKey again to produce a new plaintext data key and use it to decrypt the stored ciphertext.

Answer

Call KMS Decrypt directly on the record ciphertext stored in DynamoDB using the CMK's key ID.

Answer

Store the plaintext data key in the Lambda environment variables so it can be reused for decryption without another KMS call.

Question 18

A developer needs to encrypt several 500 MB files client-side before uploading them to Amazon S3. The application uses an AWS KMS customer managed key. The developer wants to minimize the number of KMS API calls and avoid sending the large file contents to the KMS service (KMS request payloads are limited to 4 KB). Which approach should the developer implement?

Accepted Answer

Call the KMS GenerateDataKey API to obtain a plaintext data key and an encrypted data key, use the plaintext key locally to encrypt the file, then store the encrypted data key alongside the ciphertext and discard the plaintext key from memory.

Answer

Call the KMS Encrypt API directly with the file contents as the payload, passing the customer managed key ID to encrypt each file.

Answer

Enable S3 server-side encryption with SSE-KMS on the bucket and upload the plaintext files so S3 encrypts them automatically.

Answer

Call GenerateDataKeyWithoutPlaintext to get an encrypted data key, then upload the file and the encrypted key together, letting S3 decrypt the key when needed.

Question 19

A developer is building a Lambda function that must encrypt payment records that are typically 1–2 MB in size before storing them in Amazon S3. The team wants to use a customer managed KMS key but has learned that the KMS Encrypt API rejects the payloads. What is the recommended approach to encrypt the large records using KMS?

Accepted Answer

Call KMS GenerateDataKey to obtain a plaintext data key and an encrypted data key, encrypt the record locally with the plaintext key, then discard the plaintext key and store the encrypted data key alongside the ciphertext.

Answer

Split each record into 4 KB chunks and call the KMS Encrypt API repeatedly for each chunk, then concatenate the ciphertext blocks.

Answer

Request a service quota increase for the KMS Encrypt API payload limit so records up to 2 MB can be encrypted directly.

Answer

Enable automatic key rotation on the customer managed key, which raises the maximum payload size the Encrypt API accepts.

Question 20

A company runs a data processing pipeline where a batch Lambda function must temporarily decrypt objects using a customer managed KMS key. The security team wants to grant this specific Lambda execution role decrypt permission on the key for the duration of the job without editing the KMS key policy and without granting broad, permanent access. The team also wants the ability to programmatically revoke the permission immediately when the job completes. What should the developer implement?

Accepted Answer

Create a KMS grant for the Lambda execution role principal that allows the Decrypt operation, and call RetireGrant or RevokeGrant when the job finishes.

Answer

Add the Lambda execution role ARN to the KMS key policy with kms:Decrypt, then remove it from the policy after the job completes.

Answer

Attach an identity-based IAM policy to the Lambda role granting kms:Decrypt on all keys, and detach it after the job completes.

Answer

Enable automatic key rotation on the customer managed key so the Lambda can decrypt only during the rotation window.

More DVA-C02 practice