A developer has an IAM user that needs to access an S3 bucket in another AWS account. The developer has been given an IAM role ARN to assume. What is the correct way to make authenticated calls to S3 using the AWS CLI?

Run 'aws s3 ls s3://bucket --profile other-account' after adding the role ARN to the shared credentials file.

Create a new IAM user in the target account and use its access key.

Use the IAM user's access key directly to access the bucket in the other account.

Run 'aws sts assume-role --role-arn arn:aws:iam::123456789012:role/CrossAccountRole --role-session-name mySession' and then use the returned credentials to configure the CLI.

A developer is writing a script that runs on a local machine and needs to access AWS resources. The script is used by multiple developers. The security team wants to avoid storing long-term access keys in shared files. What is the recommended approach?

Use AWS IAM Identity Center to get short-term credentials for each developer and configure the AWS CLI to use them.

Use an IAM role with a long session duration and have each developer assume it using their personal access keys.

Create a shared IAM user and store the access key in a shared credentials file.

Use environment variables with the access key and secret key set in each developer's shell profile.

A developer is writing a script that runs on an EC2 instance and needs to read from an S3 bucket. The script currently uses an IAM user's access key stored in a configuration file. The security team wants to eliminate long-term credentials. What should the developer do?

Create a new IAM user with a different access key and update the script.

Attach an IAM role to the EC2 instance and modify the script to use the instance profile credentials.

Use the root user credentials of the AWS account in the script.

Store the access key in AWS Secrets Manager and retrieve it at runtime.

A developer is building a serverless application using AWS Lambda. The Lambda function needs to write to a DynamoDB table. The developer wants to follow the principle of least privilege and avoid hardcoding any credentials. How should the function authenticate to DynamoDB?

Call the DynamoDB API with a pre-signed URL generated by another service.

Create an IAM user with permissions to DynamoDB and store the access key in environment variables.

Attach an IAM role to the Lambda function with a policy that allows the required DynamoDB actions.

Use the AWS SDK with the default credential provider chain, which will use the root user's credentials.

A developer is implementing a REST API that uses bearer tokens for authentication. What is the primary purpose of the 'Bearer' token scheme in the HTTP Authorization header?

To require the client to provide a username and password along with the token

To indicate that the token is a shared secret that must be sent in a cookie

To specify that the token is a JSON Web Token (JWT) and must be decrypted by the server

To grant the holder of the token access to the protected resource without further proof of identity

AWSCertified Developer - Associate

Domain 2Objective 1

Task 1: Implement Authentication And/or Authorization for Applications and AWS Services DVA-C02 Practice Questions (Page 4)

Part of the Content Domain 2: Security domain, which accounts for 26% of the DVA-C02 exam. AWS does not publish an official question count, but from its 130-minute exam (~50–85 total, ~13–22 in this domain), expect 4–7 from this objective — we provide 23 practice questions to prepare you well beyond it. (estimate)

23questions here

5free pages

8concepts

26%of the exam

Questions 16–20

16application · medium
A developer has an IAM user that needs to access an S3 bucket in another AWS account. The developer has been given an IAM role ARN to assume. What is the correct way to make authenticated calls to S3 using the AWS CLI?
Select an answer first
17expert · hard
A developer is writing a script that runs on a local machine and needs to access AWS resources. The script is used by multiple developers. The security team wants to avoid storing long-term access keys in shared files. What is the recommended approach?
Select an answer first
18application · medium
A developer is writing a script that runs on an EC2 instance and needs to read from an S3 bucket. The script currently uses an IAM user's access key stored in a configuration file. The security team wants to eliminate long-term credentials. What should the developer do?
Select an answer first
19application · medium
A developer is building a serverless application using AWS Lambda. The Lambda function needs to write to a DynamoDB table. The developer wants to follow the principle of least privilege and avoid hardcoding any credentials. How should the function authenticate to DynamoDB?
Select an answer first
20foundation · easy
A developer is implementing a REST API that uses bearer tokens for authentication. What is the primary purpose of the 'Bearer' token scheme in the HTTP Authorization header?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to DVA-C02

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by AWS. “DVA-C02” is a trademark of its owner, used for identification only.