Microsoft
Amazon
CompTIA
Salesforce
Cisco®
SAP
PMI
ISC
ISACA
VMware
HP
Palo Alto Networks
EC-Council
LPI
Google
Fortinet
All Vendors
  2. Home
  3. Exam List
  4. Amazon
  5. AWS Certified Developer - Associate DVA-C02

AWS Certified Developer - Associate DVA-C02
AWS Certified Developer - Associate DVA-C02 Exam

A company has an Amazon S3 bucket that contains sensitive data. The data must be encrypted in transit and at rest. The company encrypts the data in the S3 bucket by using an AWS Key Management Service (AWS KMS) key. A developer needs to grant several other AWS accounts the permission to use the S3 GetObject operation to retrieve the data from the S3 bucket.

How can the developer enforce that all requests to retrieve the data provide encryption in transit?

  1. Define a resource-based policy on the S3 bucket to deny access when a request meets the condition “aws:SecureTransport”: “false”.
  2. Define a resource-based policy on the S3 bucket to allow access when a request meets the condition “aws:SecureTransport”: “false”.
  3. Define a role-based policy on the other accounts' roles to deny access when a request meets the condition of “aws:SecureTransport”: “false”.
  4. Define a resource-based policy on the KMS key to deny access when a request meets the condition of “aws:SecureTransport”: “false”.

Answer(s): A


Reference:

https://repost.aws/knowledge-center/s3-bucket-policy-for-config-rule



An application that is hosted on an Amazon EC2 instance needs access to files that are stored in an Amazon S3 bucket. The application lists the objects that are stored in the S3 bucket and displays a table to the user. During testing, a developer discovers that the application does not show any objects in the list.

What is the MOST secure way to resolve this issue?

  1. Update the IAM instance profile that is attached to the EC2 instance to include the S3:* permission for the S3 bucket.
  2. Update the IAM instance profile that is attached to the EC2 instance to include the S3:ListBucket permission for the S3 bucket.
  3. Update the developer's user permissions to include the S3:ListBucket permission for the S3 bucket.
  4. Update the S3 bucket policy by including the S3:ListBucket permission and by setting the Principal element to specify the account number of the EC2 instance.

Answer(s): B

Explanation:

Option A also works, but it is not compliant to the AWS security practice of the least privilege permissions.


Reference:

https://repost.aws/knowledge-center/ec2-instance-access-s3-bucket



A company is planning to securely manage one-time fixed license keys in AWS. The company's development team needs to access the license keys in automaton scripts that run in Amazon EC2 instances and in AWS CloudFormation stacks.

Which solution will meet these requirements MOST cost-effectively?

  1. Amazon S3 with encrypted files prefixed with “config”
  2. AWS Secrets Manager secrets with a tag that is named SecretString
  3. AWS Systems Manager Parameter Store SecureString parameters
  4. CloudFormation NoEcho parameters

Answer(s): C

Explanation:

AWS Secrets Manager does auto key rotation(The question says that the key is one-time fixed).


Reference:

https://docs.aws.amazon.com/systems-manager/latest/userguide/systems-manager-parameter-store.html



A company has deployed infrastructure on AWS. A development team wants to create an AWS Lambda function that will retrieve data from an Amazon Aurora database. The Amazon Aurora database is in a private subnet in company's VPC. The VPC is named VPC1. The data is relational in nature. The Lambda function needs to access the data securely.

Which solution will meet these requirements?

  1. Create the Lambda function. Configure VPC1 access for the function. Attach a security group named SG1 to both the Lambda function and the database. Configure the security group inbound and outbound rules to allow TCP traffic on Port 3306.
  2. Create and launch a Lambda function in a new public subnet that is in a new VPC named VPC2. Create a peering connection between VPC1 and VPC2.
  3. Create the Lambda function. Configure VPC1 access for the function. Assign a security group named SG1 to the Lambda function. Assign a second security group named SG2 to the database. Add an inbound rule to SG1 to allow TCP traffic from Port 3306.
  4. Export the data from the Aurora database to Amazon S3. Create and launch a Lambda function in VPC1. Configure the Lambda function query the data from Amazon S3.

Answer(s): A

Explanation:

Based on the requirement to access the Amazon Aurora database securely from the Lambda function, the correct solution is A. The Lambda function needs to be configured to access resources in VPC1, where the database is located. A security group (SG1) should be attached to both the Lambda function and the database, and the inbound and outbound rules of SG1 should allow TCP traffic on port 3306 to enable communication between the Lambda function and the database. This approach ensures that the connection between the Lambda function and the database is secure and the data is accessed only through the allowed port.


Reference:

https://repost.aws/en/knowledge-center/connect-lambda-to-an-rds-instance




kris J.
Now my dream has come true. I thank you a million times for the best study guides that you provided to a poor kid like me....I got it. Finally MCSE. Best regards,
- GERMANY
Upvote


Jason
I passed my CCNA exam yesterday. I would like to make some comments. "Excellent Study Guide, Excellent Support Service, Excellent Examination Web Site" Best Regards
- UNITED STATES
Upvote


Micheal
Thanks for your study guides, i have passed it. All questions in your material, we study this only 2 days. Thanks very very much!!!!!
- UNITED STATES
Upvote


L. Woo
Thanks very much for your study guides, with your help i only use 3 weeks to take the MCSE. Your study guides are very very good.
- China
Upvote


Mick H.
I passed the CCIE Written exam 350-001 last Friday, Thanks very much for your study guide and your help.
- UNITED STATES
Upvote


Hagit
i ust wanted to thank you folks at braindumgalaxy.com for your assistance. I used your CCNP exams for practice and to identify my weak areas. Passed the CCNP recert on Tuesday without any big problems.
- Israel
Upvote


Cisco Engineer
I have found that your resources are probably the best on the market...and I work at Cisco.
- UNITED STATES
Upvote


Koshani
A well Good morning Dear braindumpgalaxy.com Team I wanna say that I passed the 000-888 yesterday and i am happy
- UNITED STATES
Upvote


Aized
I took the A+ hardware exam yesterday and thanks to your excellent and helping preparation material. I got a nice score.
- Pakistan
Upvote


Nazanin
I passed the exam with great distinction!
- CANADA
Upvote

Read more ...