Task 1: Implement Authentication And/or Authorization for Applications and AWS Services DVA-C02 Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A developer is building a web application that allows users to view and edit their own profile. The application uses a JWT for authentication. The developer needs to ensure that a user can only modify their own profile, not other users'. What is the best way to enforce this?

   • ARely on the JWT signature to ensure the request is from the user.
   • BUse an IAM policy that allows the user to update any profile in the database.
   • CCreate a separate IAM role for each user and use it to access the database.
   • DInclude the user ID in the JWT and use it to validate that the profile ID in the request matches the token's user ID.
   Reveal Solution Discussion Select an answer first
2. 7application · medium

   A developer is designing a microservices architecture on AWS. Service A needs to call Service B, which is an internal HTTP API. The developer wants to authenticate the call without managing user credentials. What is a secure and recommended method?

   • AUse a shared secret stored in an environment variable and compare it in Service B.
   • BHave Service A assume an IAM role and use the temporary credentials to sign the HTTP request to Service B.
   • CUse mutual TLS with certificates issued by a public CA.
   • DEmbed an API key in the source code of Service A and send it in the header.
   Reveal Solution Discussion Select an answer first
4. 8expert · hard

   A company has a microservices architecture running on Amazon ECS. Service A needs to call Service B, which is behind an Application Load Balancer (ALB). The security team requires that Service B only accepts requests from Service A, not from any other client. The developer wants to avoid managing certificates or API keys. What is the most appropriate solution?

   • AUse an API key that is passed in the header and validated by Service B.
   • BUse IAM roles for tasks and have Service A sign the HTTP request with SigV4; configure Service B to verify the signature using IAM.
   • CUse a security group on Service B that only allows traffic from the security group of Service A.
   • DUse mutual TLS with certificates issued by AWS Certificate Manager (ACM).
   Reveal Solution Discussion Select an answer first
5. 9application · medium

   A developer is running a batch job on an EC2 instance that needs to access a Secrets Manager secret. The instance is already configured with an IAM role. What is the correct way to retrieve the secret in the code?

   • ACall the AWS Secrets Manager API using the SDK, which automatically uses the instance profile credentials.
   • BUse the AWS CLI command 'aws secretsmanager get-secret-value' with the access key stored in a file.
   • CSet the secret as an environment variable in the EC2 user data script.
   • DRead the secret from the instance metadata service (IMDS) directly.
   Reveal Solution Discussion Select an answer first
6. 10foundation · easy

   An application running on an EC2 instance needs to access an Amazon S3 bucket. The developer wants to avoid storing long-term AWS access keys on the instance. Which AWS feature should be used to grant the EC2 instance temporary credentials for this access?

   • AAn IAM role attached to the EC2 instance profile
   • BAn IAM user with a long-term access key and secret key stored in the application code
   • CA pre-signed URL generated by the application for every S3 request
   • DAn S3 bucket policy that allows public read access to the bucket
   Reveal Solution Discussion Select an answer first