Home › Certifications › AWS Certified Developer DVA-C02 › Security
38 multiple-choice questions and 23 flashcards on Security, about 25% of the AWS Certified Developer DVA-C02 bank. Every one carries a written rationale.
Security is one of 4 chapters in CoStudy's AWS Certified Developer — Associate (DVA-C02) bank, and it holds 38 of the bank's 150 multiple-choice questions — roughly 25% of the total. That proportion is not arbitrary: chapters follow the certifying body's published exam outline, and the number of questions in each is set by that domain's published weight, so the share of your practice time this chapter takes matches the share of the real exam it accounts for.
Studying by chapter is worth doing once you have a diagnostic score. A single overall percentage tells you whether you are close; it does not tell you which domain is dragging. Working a weak chapter in isolation, and re-testing it in isolation, is the fastest way to move a score that has stalled — and it is why the mock exams in CoStudy report by domain rather than as one number.
10 questions drawn from this chapter, with the full rationale shown — the controlling principle behind the right answer, and why each wrong option tempts and fails.
Which Cognito flow lets a mobile app get temporary AWS credentials AFTER user-pool sign-in?
Answer: B — Federated identity via identity pool
A) API keys are not identity credentials. C) SigV4 signs requests once you already have creds. B) Correct — the identity pool exchanges the user-pool ID token for temporary AWS creds. D) SAML is not the Cognito user-pool flow.
Which IAM configuration ensures an EC2 instance can call AWS APIs without embedded credentials?
Answer: C — Instance profile (IAM role) attached
A) Embedded keys leak and can't rotate cleanly. C) Correct — instance profiles inject rotating STS credentials via the metadata service. B) Root creds are highest-risk. D) Sharing profiles undermines identity attribution.
Which KMS setting enables AUTOMATIC yearly rotation of the underlying key material?
Answer: A — Enable key rotation on the CMK
A) Correct — customer-managed KMS keys support built-in yearly rotation with prior material retained. B) Recreation loses continuity. C) Imported material can't be auto-rotated. D) Publishing keys is anti-pattern.
Which Cognito construct is the user directory that issues JWT ID and access tokens after sign-in?
Answer: A — Cognito User Pool
A) Correct — user pools handle sign-up, sign-in, MFA, and issue JWTs. B) Identity pools swap tokens for temporary AWS IAM credentials. C) Identity Center handles AWS console federation. D) Directory Service is AD-compatible for enterprise apps.
Which VPC construct exposes a service across accounts privately without traversing the internet?
Answer: B — AWS PrivateLink endpoint service
A) IGWs are public egress; not a cross-account share. B) Correct — PrivateLink publishes a service via VPC endpoints consumable in other VPCs and accounts. C) TGW is broader transit. D) NAT is outbound public egress.
Which service issues TLS certificates for API Gateway custom domains at NO cost?
Answer: D — AWS Certificate Manager (ACM) free
A) Secrets Manager stores secrets, not certificates. D) Correct — ACM issues and auto-renews public TLS certs used by API Gateway, ALB, and CloudFront. C) KMS manages encryption keys. B) SSM is operations tooling.
How should an ECS Fargate task authenticate to AWS APIs to read from a specific S3 bucket?
Answer: D — Attach a task IAM role scoped to that bucket
A) Baking keys risks image leaks and blocks rotation. D) Correct — task roles inject temporary credentials via the metadata endpoint. C) Fargate has no user-managed host; instance profiles don't apply. B) Shared filesystem creds are neither scoped nor rotated.
Which is the RECOMMENDED way to grant permissions to workloads running on AWS?
Answer: C — IAM roles with STS temp credentials
A) Root keys are the highest-risk anti-pattern. B) Static user keys are long-lived and hard to rotate. C) Correct — roles vend short-lived STS credentials scoped to the workload. D) Signed URLs are for specific object access.
Which policy is required at MINIMUM on every Lambda execution role for logging?
Answer: D — AWSLambdaBasicExecutionRole
A) S3 read is unrelated to logging. D) Correct — BasicExecutionRole grants CreateLogGroup/Stream and PutLogEvents. C) VPCAccess is only needed when VPC-attached. B) Admin access violates least privilege.
How can a REST API require a signed request from any IAM principal in the caller's account?
Answer: A — IAM authorization using SigV4 signing
B) User pools authenticate end users, not IAM principals. A) Correct — the IAM authorizer requires SigV4 signatures from valid IAM identities. C) Custom Lambda auth is a token model. D) API keys authenticate clients.
4 cards from the 23 in this chapter.
API Gateway authorization types?
IAM, Cognito user pools, Lambda authorizers (custom), API keys.
Resource-based vs identity-based policy?
Identity-based: attached to user/role. Resource-based: attached to resource (e.g., S3 bucket).
Best practice: store credentials where?
Never in code. Use IAM roles for EC2/ECS/Lambda. Or env vars / shared credentials file.
VPC Endpoints?
Private connections to AWS services without internet. Gateway (S3, DynamoDB) or Interface (others).
These are a sample. The full Security chapter runs 61 items with per-chapter progress tracking, on the web and in the iOS app.
Open AWS Certified Developer DVA-C02 in CoStudy →