DVA-C02 Security: 343 practice questions

12 of the 343 Security questions in the Certsqill DVA-C02 bank, shown in full below. Each one carries an explanation for every option, not just the correct one — the wrong answers are where the marks go.

Preparing for DVA-C02? Take the free 5-min readiness check →

1. Use a Cognito user pool and send a validated access token: Which configuration should the developer use?

1. Use IAM Identity Center to obtain credentials for signed AWS API requests.

   AWS credentials for signing requests do not replace the required application OAuth access token.
2. Use a Cognito user pool and send a validated access token to the API. ✓

   A user pool authenticates users and issues JWTs. An access token carries scopes and authorization claims intended for APIs; the application must validate its signature, issuer, and expiration before trusting it.
3. Use a Cognito identity pool and sign requests with temporary AWS credentials.

   This supports AWS credential-based access, rather than the required OAuth access-token authorization.
4. Use a Cognito user pool and send its ID token to the API.

   An ID token describes the authenticated identity; this API specifically requires an access token with a scope.

Use a Cognito user pool for user authentication and an access token for API authorization, validating the JWT before use.

2. Encrypt each document with a data key: Which design implements envelope encryption?

1. Store the plaintext data key next to each encrypted document.

   Retaining the plaintext key next to the ciphertext defeats the intended key protection.
2. Encrypt each document with a data key, encrypt that data key with a KMS key, and store the encrypted data key with the ciphertext. ✓

   This separates payload encryption from key protection: the data key encrypts the document, while the KMS key encrypts the data key. The encrypted data key can be stored with the ciphertext.
3. Rotate the KMS key periodically and keep the documents unencrypted in the data store.

   Key rotation does not encrypt documents that the application stores as plaintext.
4. Encrypt each document directly with the KMS key, and store only the resulting ciphertext with the document.

   This omits the data key that envelope encryption uses to encrypt application data. Envelope encryption instead has the KMS key protect the data key.

Use a data key for the document and use the KMS key to encrypt that data key. Store the encrypted data key with the ciphertext.

3. A Cognito user pool: Which Cognito component should an application use to authenticate users and issue JWTs fo

1. A Cognito user pool ✓

   User pools provide user authentication and issue application tokens.
2. An IAM execution role

   An execution role grants permissions to workloads; it is not an application sign-in service.
3. An AWS STS AssumeRole session

   AssumeRole provides temporary AWS credentials, not an application user directory and sign-in tokens.
4. A Cognito identity pool

   Identity pools exchange identity information for AWS credentials; user pools provide the requested sign-in and JWT issuance.

Use a Cognito user pool for user authentication and JWT issuance; use an identity pool when temporary AWS credentials are required.

4. A data key encrypts application data: Which statement accurately describes envelope encryption using AWS KMS?

1. Hash each document and store only the hash for later decryption.

   Hashing is not reversible encryption.
2. A data key encrypts application data, while a KMS key encrypts the data key. ✓

   Envelope encryption uses the data key for the application data and the KMS key to protect that data key.
3. Store an unencrypted data key alongside the encrypted application data.

   This exposes the key needed to decrypt the protected data.
4. Rotate the KMS key without encrypting application data.

   Key rotation does not encrypt the application data.

Envelope encryption uses a data key for application data and a KMS key for the data key.

5. Apply a CloudWatch Logs data protection policy: Which solution meets these requirements?

1. Use CloudWatch Logs Insights queries to hide sensitive fields.

   Logs Insights can filter, aggregate, and analyze events, but querying does not provide the log-event masking control required here.
2. Enable structured JSON logging for the Lambda runtime.

   Structured JSON logging improves filtering and analysis of supported fields, but it does not mask configured sensitive data identifiers.
3. Apply a CloudWatch Logs data protection policy. ✓

   CloudWatch Logs data protection policies can audit and mask configured sensitive data identifiers in log events, reducing exposure to viewers without unmasking permission.
4. Add API Gateway request validation for sensitive fields.

   API Gateway request validation checks parameters and request-body schemas before backend invocation; it does not mask values already written to logs.

CloudWatch Logs data protection policies mask configured sensitive identifiers without requiring application-code changes.

6. Supply an AssumeRole session policy that restricts: Which approach should the developer use?

1. Add the required permissions to the caller’s policy before calling AssumeRole.

   The caller’s permission to assume the target role authorizes the role assumption; adding permissions there does not narrow the permissions granted by the target role. Effective session permissions can instead be restricted with a session policy.
2. Grant the job a second role whose policy contains only the required permissions.

   A separate narrowly scoped role could provide restricted permissions, but it changes the shared role arrangement rather than using the requested session-level restriction. AssumeRole session policies are designed to further restrict temporary credentials.
3. Modify the role trust policy to list only the job’s required permissions.

   The trust policy controls which principals may assume the role; it does not define the permissions available after assumption. Session permissions come from the role policy and any further session restriction.
4. Supply an AssumeRole session policy that restricts the temporary credentials to the job’s required permissions. ✓

   An AssumeRole session policy can further restrict temporary role credentials. The resulting permissions are the intersection of the role policy and the supplied session policy, so the session cannot exceed the narrower job permissions.

Use an AssumeRole session policy to narrow the temporary credentials without changing the shared role policy.

7. Configure Secrets Manager rotation and refresh the client: Which approach best meets these requirements with t

1. Update the KMS key policy and rely on cached clients to receive the new password.

   A KMS key policy controls access to the key, while client-side caching requires a refresh before clients observe a rotated Secrets Manager value.
2. Configure Secrets Manager rotation and refresh the client cache after rotation. ✓

   Secrets Manager rotation can update both the stored secret and supported target database or service. The client cache must refresh to observe the new value.
3. Enable automatic rotation for the KMS key encrypting the database password.

   KMS key rotation changes key material used for encryption and remains transparent during decryption; it does not update the database password or application secret.
4. Use envelope encryption and periodically replace the encrypted data key.

   Envelope encryption uses a data key for application data and a KMS key to encrypt that data key; it does not provide managed rotation of a database credential in its target service.

Secrets Manager rotation updates the stored secret and supported target service; cache refresh makes the new value visible to clients.

8. CloudWatch Logs data protection policies: Which AWS capability can audit and mask configured sensitive data id

1. CloudWatch Logs data protection policies ✓

   CloudWatch Logs data protection policies can audit and mask configured sensitive data identifiers in log events, reducing exposure to viewers without permission to unmask them.
2. Lambda structured JSON logging

   Structured JSON makes supported Lambda logs easier to filter and analyze, but it does not provide the stated audit-and-mask capability for sensitive identifiers.
3. CloudWatch Logs Insights queries

   A query can hide fields in its own output but does not enforce masking for other viewers.
4. CloudWatch embedded metric format

   Embedded metric format extracts metric values from structured JSON log events for graphs and alarms; it is not described as a control for masking sensitive identifiers.

CloudWatch Logs data protection policies provide the stated audit-and-mask behavior for configured sensitive data identifiers.

9. Configure a CloudWatch Logs data protection policy: Which solution best meets these requirements?

1. Use CloudWatch Logs Insights queries to filter sensitive fields from every troubleshooting result.

   Logs Insights can filter, aggregate, and analyze events without exporting them, but querying does not establish masking for the underlying log data or all viewers.
2. Add API Gateway request validation to reject requests containing sensitive payment identifiers.

   Request validation checks required parameters and request-body schemas before backend invocation; it does not mask sensitive values that the Lambda function writes to CloudWatch Logs.
3. Configure a CloudWatch Logs data protection policy to audit and mask the configured sensitive data identifiers. ✓

   This directly provides masking for configured sensitive data identifiers while allowing log events to remain available to viewers without permission to unmask the protected values.
4. Enable structured JSON logging for the supported Lambda runtime fields and analyze the resulting log groups.

   Structured JSON makes supported runtime logs easier to filter and analyze, but it does not itself mask sensitive data identifiers in log events.

A CloudWatch Logs data protection policy directly audits and masks configured sensitive data identifiers while preserving log availability for authorized troubleshooting.

10. Assume the role and provide a session policy limiting: Which approach meets the requirement?

1. Assume the role and provide a session policy limiting actions and resources to the deployment. ✓

   An AssumeRole session policy can further restrict temporary credentials. Its effective permissions intersect with the role permissions, so it cannot expand access beyond the role policy.
2. Assume the role without a session policy and request a shorter session duration.

   Reducing credential lifetime does not narrow the actions or resources authorized during that lifetime.
3. Update the role policy with deployment resources before every role assumption.

   Changing the role policy is unnecessary when per-session restriction is required. A session policy provides the narrower temporary permission boundary while the role remains usable.
4. Add the developer to Account B and use the developer's long-term permissions.

   Long-term user credentials do not restrict the permissions of an assumed-role session.

Use an AssumeRole session policy to narrow each temporary session. Effective permissions are the intersection of the role policy and session policy.

11. Use a customer managed KMS key for Lambda environment: Which design satisfies both requirements with the least

1. Use envelope encryption for the configuration and ALB HTTPS routing for the TCP service.

   Envelope encryption protects application data by using a data key encrypted by a KMS key, but ALB HTTPS routing remains an HTTP or HTTPS Layer 7 mechanism and does not satisfy the non-HTTP TCP constraint.
2. Use a SecureString parameter for the configuration and ALB path-based routing for the TCP service.

   SecureString parameters use AWS KMS encryption, but ALB path-based routing is an HTTP or HTTPS Layer 7 mechanism rather than a fit for the non-HTTP TCP service.
3. Use a customer managed KMS key for Lambda environment variables and ALB host-based routing for the TCP service.

   The KMS configuration addresses at-rest protection, but ALB listener rules route HTTP and HTTPS requests and therefore do not match the stated non-HTTP TCP requirement.
4. Use a customer managed KMS key for Lambda environment variables and an NLB TLS listener for the TCP service. ✓

   Lambda supports a customer managed KMS key for environment variables at rest, while Network Load Balancers support transport-layer TCP and TLS traffic for the service endpoint.

Choose a customer managed KMS key for Lambda environment variables and an NLB TLS listener for the non-HTTP TCP service.

12. Configure a CloudWatch Logs data protection policy: Which solution meets these requirements with the least amo

1. Enable structured JSON logging for the Lambda runtime and redact sensitive fields during log analysis.

   Structured JSON logging makes supported runtime logs easier to filter and analyze, but it does not itself mask sensitive values in retained log events. Redaction during analysis leaves the original logged values exposed.
2. Use CloudWatch Logs Insights queries to exclude sensitive fields from troubleshooting results.

   Logs Insights can filter, aggregate, and analyze events without exporting them, but query filtering does not sanitize the underlying log events. Sensitive values can remain available in the log group.
3. Configure a CloudWatch Logs data protection policy to audit and mask the sensitive data identifiers. ✓

   CloudWatch Logs data protection policies can audit and mask configured sensitive data identifiers in log events. Masking reduces exposure for viewers who lack permission to unmask the protected data.
4. Add an API Gateway request validator to reject requests containing sensitive identifiers.

   API Gateway request validators check required parameters and request-body schemas before backend invocation. They do not mask sensitive data already written to application logs and could prevent valid requests rather than sanitize logging.

A CloudWatch Logs data protection policy directly audits and masks configured sensitive identifiers while retaining the log events.

Other DVA-C02 domains

• Development with AWS Services — 424 questions →
• Deployment — 321 questions →
• Troubleshooting and Optimization — 238 questions →
• All 1326 DVA-C02 questions →