Security

DVA-C02 · 78 questions

• Residents should sign into the parks mobile app with the city’s existing social/OIDC identity provider without the app storing passwords. Which approach fits?
• After Cognito login, the parks mobile app must upload photos to each citizen’s own S3 prefix using temporary AWS credentials. Which Cognito capability vends those credentials?
• API Gateway protects municipal APIs with JWTs issued after Cognito login. What must backends do on each call?
• A CI build role must push an image to Amazon ECR without access keys in the Jenkinsfile. How should programmatic access be configured?
• A city permitting portal runs on Elastic Beanstalk and must call DynamoDB from the app without hard-coding AWS keys. How should the SDK authenticate?
• A county payments Lambda in Account A must write audit objects into a logs bucket owned by Account B. Which approach correctly grants temporary, scoped access?
• An inspection-api ECS task role must read case rows from one DynamoDB table. Which permissions statement best matches least privilege?
• Two municipal clerks share the same Cognito group for the permit desk but must edit permits only for their own district. What should the application enforce beyond the shared group?
• A city’s fees microservice must call the ledger microservice with authenticated identity and must not share end-user passwords between services. Which pattern fits?
• Uploads to a municipal evidence bucket should succeed only when the object key prefix matches the caller’s department tag. Which IAM technique enforces that attribute-based rule?
• A partner county role in another AWS account must read objects under a shared GIS export prefix in the city’s S3 bucket. Which policy placement is the clean cross-account pattern?
• A contractor committed long-term AWS access keys for a city recreation app into a public Git repository. What should the team do first for application access going forward?
• A public single-page app for resident park reservations uses Amazon Cognito. How should the Cognito app client be configured for that SPA?
• Unauthorized callers should be rejected before a city grants Lambda runs for a protected API. Where should JWT validation happen?
• A break-glass admin CLI session for a municipal tax tool should avoid permanent access keys on a laptop. What is the preferred credential pattern?
• A developer for a county tax service chains three AssumeRole hops because a blog sample did, which complicates audits. What should the team prefer?
• A new Lambda for building-permit webhooks fails because it cannot assume its execution role. The role’s trust policy does not allow the Lambda service. What should be fixed?
• A read-only open-data client token must not be able to call write endpoints on the same municipal API. How should access be enforced?
• An AWS Organizations SCP blocks s3:DeleteObject citywide. A purge job’s application role policy allows s3:DeleteObject on a staging bucket. What happens?
• City employees authenticate through a workforce identity provider, while residents use Amazon Cognito user pools for citizen apps. What identity approach should the team keep?
• A custom HTTP client on a lobby kiosk signing AWS API requests fails with SignatureDoesNotMatch after the kiosk clock drifts. What SigV4 requirement is most likely involved?
• A CI pipeline role may deploy one SAM stack in the city’s test account but must not create IAM users. How should that deploy principal be scoped?
• Mobile inspectors remain in the field for hours; access tokens expire and uploads begin failing silently. What should the client implement?
• Before shipping, a developer checks whether an IAM policy that allows dynamodb:Query only on a table ARN also covers Query calls that target a global secondary index. What should they understand?
• Account A must put events onto an EventBridge event bus in Account B for a multi-account city services mesh. What must be true?
• A burst of credential-stuffing attempts hits the citizen login API in front of API Gateway/CloudFront. Which edge control is commonly proposed?
• A ticket asks an application developer to create twenty IAM users with passwords for external contractors on a city project. Relative to the DVA-C02 target role, what is the better framing?
• A case-management app grants access when the caller’s PrincipalTag Department equals department tags on case-folder resources. Which authorization model is this?
• A small town wants a quick compliant hosted login page for a citizen portal, while a larger city needs fully branded screens that call Cognito APIs directly. How should each choose?
• A city permitting API returns bearer tokens to mobile clients. A developer proposes logging every Authorization header to CloudWatch Logs for easier debugging. What should the team do?
• A county runs a public citizen API and a payroll microservice as separate ECS services. Security wants a breach of the public API task unable to write to payroll DynamoDB tables. How should task IAM be designed?
• A city open-data team needs a partner system to pull a bulk GIS feed with rate limits, while citizens still sign in to a separate account portal. Which auth approach fits each audience?
• A municipal Lambda role is allowed kms:Decrypt by its identity policy, but sealed case PDFs still fail to open. An SCP on the account includes an explicit Deny for kms:Decrypt. What explains the failure?
• During an incident, a county break-glass role can be assumed with broad S3 read. Responders must further limit temporary credentials so s3:GetObject works only under the evidence/incident-42/ prefix. What should they pass when assuming the role?
• A parks department app lets guests browse public park maps without signing in, but write APIs for reservation changes must require authenticated users. How should Cognito identity pools be used?
• A nightly batch reconciler with no human operator must call an internal municipal fees API that expects OAuth tokens. Which approach is appropriate?
• A city council member asks whether requiring HTTPS to DynamoDB means citizen records are encrypted on disk inside AWS. What should the developer explain?
• Internal microservices for a city’s tax stack must authenticate to each other with TLS certificates that are not public website certs. Which approach fits?
• Highly sensitive case files must be encrypted in the application before PutObject so AWS never sees plaintext, while ordinary park-photo buckets can use SSE-S3 or SSE-KMS. What contrast should developers apply?
• A Lambda that connects to a legacy host must decrypt a sealed configuration blob using a customer managed KMS key before startup. What must the function do?
• Developers need SSH key pairs for a bastion jump box used only in the city’s sandbox account during feature work. What is the sound practice?
• Account A owns a KMS CMK that encrypts objects in a shared evidence bucket. Account B’s application role must decrypt those objects. What must be configured?
• Security policy requires annual automatic rotation for customer managed KMS keys that protect citizen PII DynamoDB tables. What should the developer enable?
• Open-data park assets need simple server-side encryption, while regulated PHI attachments need customer managed keys with CloudTrail-visible key use. How should developers choose?
• A municipal batch job encrypts multi-gigabyte evidence files with KMS. Why should it use data keys (envelope encryption) instead of sending entire payloads to the KMS Encrypt API?
• Citizen browsers must reach the city services portal only over HTTPS with a valid certificate on the custom domain. What should the team configure?
• A new Aurora cluster will store municipal health records. Security requires encryption at rest from day one. What should the team do when provisioning?
• The city requires customer-controlled keys and audit of key use for a DynamoDB table of sealed case indexes. Do AWS owned keys meet that bar?
• Two microservices exchange sensitive permit payloads inside the city’s VPC. A developer claims private subnets make TLS unnecessary. What is the better guidance?
• Municipal app config currently hard-codes raw KMS key IDs. Operators want rotations and re-pointing without hunting every service for ARNs. What practice helps?
• During an incident drill, an operator disables a CMK that still encrypts historical archive objects an archives Lambda must decrypt. What operational impact should the team expect?
• All new objects in the city’s evidence bucket must be stored with SSE-KMS even when an SDK PutObject omits encryption headers. What should administrators set?
• A lab misconfiguration pointed the AWS SDK at a custom DynamoDB endpoint over HTTP, creating a risk of credential and data exposure. What must production clients use?
• A project manager says signing the Lambda deployment package with code signing means citizen SSN fields are encrypted at rest in DynamoDB. What distinction should the developer draw?
• A county grants portal shares a KMS customer managed key with a partner AWS account so the partner can decrypt grant packages in S3. The partner must not administer the key, create grants for others, or change the key policy. What should the city grant?
• The city wants api.city.gov as a custom domain on API Gateway and needs a publicly trusted TLS certificate that ACM can manage where regional API Gateway custom domains are supported. Which approach fits?
• Citizen profiles in DynamoDB are ordinary JSON documents, but Social Security numbers must remain unreadable even to operators who can read the table in the console. Only those SSN fields should be protected this way. What should the application do?
• A legacy report engine on EC2 writes citizen extracts to an attached data volume. Security requires that volume's data be encrypted at rest. What should the developers ensure?
• An AMI for the parks payment listener was baked with TLS private keys in the image for "convenience." Every new instance clone now carries those keys. What is the secure fix?
• After a contractor is offboarded, the city must re-encrypt a subset of grant files under a new data-key hierarchy so the contractor's former access path cannot decrypt them. What should the application team plan?
• A parks dataset mixes public park hours with resident home addresses and phone numbers. Logging currently writes both kinds of fields the same way to CloudWatch. What should developers do first?
• A municipal health clinic app stores appointment notes that qualify as PHI. Ordinary public-works service tickets in another module do not. What should the team recognize when securing the clinic notes?
• Database passwords for the permits API were pasted into plaintext Lambda environment variables that broad IAM roles can read in the console. What is the preferred remediation?
• The business-license renewal Lambda must obtain RDS credentials at runtime with managed rotation, not from a checked-in .env file in the repository. Which approach meets that requirement?
• Exception handlers in the payments API dump full HTTP bodies into CloudWatch Logs, and some bodies contain cardholder data fragments. What should developers change?
• Help-desk staff verifying a resident on the city portal should see only the last four digits of the SSN on identity screens, not the full number. Where should that control be enforced for the UI?
• Two school districts share one SaaS-style deployment of a student services app. Queries must never return another tenant's student rows even if object IDs are similar. What multi-tenant data pattern should the code enforce?
• RDS credentials in Secrets Manager rotate every 30 days. The grants API caches the secret in memory and must keep serving traffic when rotation occurs. What should the application implement?
• A React single-page app for recreation registration embeds a privileged Cognito app client secret and a long-lived AWS access key in the browser bundle. What should the team do?
• The city payment form already receives a processor token after card settlement, but the app still stores full card PANs in DynamoDB "for convenience." What is the correct data-minimization action?
• Feature flags for the portal can be ordinary configuration, but third-party API tokens must not sit in plaintext parameters. How should Parameter Store / Secrets Manager usage be matched to sensitivity?
• Tenant A's JWT must not authorize Tenant B's API paths even when object IDs are guessable. Beyond verifying the JWT signature, what must the API enforce?
• A debug export tool used by support engineers dumps full date-of-birth values and medical notes from tickets by default. What should be built into that operational tooling?
• Auditors ask the grants team to confirm that the production Secrets Manager secret store protecting database credentials uses encryption at rest with an appropriate customer managed key policy. What should they verify?
• A CloudFormation template parameter Default embeds the production webhook signing secret in version control. How should the team supply that secret instead?
• Clickstream analytics for the city portal accidentally forwards raw resident email addresses into a less-controlled OpenSearch index used by interns. What should the pipeline do?
• District file uploads land under s3://bucket/{tenantId}/... and IAM policies must ensure a principal can only access its own tenant prefix. Which pattern supports enforceable isolation?
• API 500 responses currently return SQL text and row images of citizen records to make debugging easier for mobile clients. What should the API return instead?