Task 1: Implement Authentication And/or Authorization for Applications and AWS Services DVA-C02 Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   A developer is building a web application that needs to allow users to sign in with their existing corporate credentials (e.g., from an on-premises Active Directory or a third-party IdP). Which AWS service is designed to handle this federated authentication flow for the application?

   • AAWS Identity and Access Management (IAM) alone, by creating a user for each corporate employee
   • BAWS Secrets Manager to store the corporate credentials for the application to use
   • CAWS Key Management Service (KMS) to manage the cryptographic keys for the federation
   • DAmazon Cognito user pools, configured with an identity provider (IdP) federation
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   A developer needs to allow an IAM user to temporarily access an S3 bucket that belongs to another AWS account. What is the recommended way to grant this access?

   • AShare the access key of the IAM user with the other account
   • BAdd the IAM user to the bucket's ACL in the other account
   • CCreate a new IAM user in the other account with the same name and password
   • DCreate an IAM role in the other account and allow the IAM user to assume it
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   A developer is writing a Python script using the AWS SDK (boto3) to list objects in an S3 bucket. What is the first step the SDK performs to make an authenticated call?

   • AIt uses the IAM role attached to the S3 bucket to authenticate
   • BIt sends the credentials to the AWS STS service to get a session token first
   • CIt retrieves credentials from the environment, shared credentials file, or IAM role, and uses them to sign the request
   • DIt sends the access key and secret key in the HTTP request body
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   A developer is building a microservices architecture where Service A needs to call Service B. Both services run on AWS. What is a recommended way to authenticate the call from Service A to Service B?

   • AUse the same IAM user for both services
   • BEmbed Service B's API key in Service A's code
   • CSend the credentials in the HTTP header without signing
   • DUse an IAM role attached to Service A's compute resource, and use SigV4 to sign the request to Service B
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   An application running on an EC2 instance needs to access an Amazon DynamoDB table. The developer wants to avoid managing long-term access keys. What is the most secure way to grant the EC2 instance the necessary permissions?

   • AUse the root user's access key for the application
   • BCreate an IAM user with an access key and embed it in the application's configuration file
   • CCreate an IAM role with a policy that allows DynamoDB access, and attach it to the EC2 instance profile
   • DCreate a pre-signed URL for the DynamoDB table and use it in the application
   Reveal Solution Discussion Select an answer first