Task 3: Manage Sensitive Data in Application Code DVA-C02 Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A developer is writing a Lambda function that processes credit card transactions. The function logs the request payload for debugging. The security team has mandated that credit card numbers (PANs) must never appear in logs. What should the developer do?

   • AUse a logging library to redact the credit card number field before writing the log entry.
   • BRemove the logging statement entirely from the Lambda function.
   • CLog the entire request payload as-is to ensure all data is available for debugging.
   • DEncrypt the entire log output using an AWS KMS key before sending it to CloudWatch Logs.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A developer is building a data export feature for a multi-tenant application. The export includes customer data. The developer wants to provide a 'masked' version of the export for non-production use. The data includes names, email addresses, and phone numbers. What is the most effective way to create the masked export?

   • AUse the production data as-is for the export and rely on the non-production environment's security controls to protect it.
   • BEncrypt the export file with a KMS key and share the key with the non-production team.
   • CWrite a script that queries the production database and replaces the sensitive fields with random but realistic-looking data before writing the export file.
   • DDelete the sensitive fields from the export file and only include non-sensitive data.
   Reveal Solution Discussion Select an answer first
4. 18foundation · easy

   In a multi-tenant application, what is the primary goal of tenant isolation?

   • ATo ensure that each tenant's data is accessible only to that tenant.
   • BTo reduce the number of AWS accounts needed.
   • CTo allow all tenants to share the same data for efficiency.
   • DTo simplify the application code by using a single database.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A developer is deploying a containerized application to Amazon ECS. The application needs a database password. The developer is considering using AWS Secrets Manager. The security team requires that the password be rotated automatically. The application is written in Python and uses the boto3 library. What is the most efficient way to integrate Secrets Manager with the ECS task?

   • AUse the ECS task definition's 'secrets' option to inject the secret as an environment variable, and let the ECS agent handle the retrieval.
   • BWrite custom Python code in the application to call boto3 to retrieve the secret at startup.
   • CUse AWS AppConfig to store the secret and retrieve it using the AppConfig agent.
   • DStore the secret in a file in an S3 bucket and mount it to the container using a data volume.
   Reveal Solution Discussion Select an answer first
6. 20foundation · easy

   A developer wants to use a customer-managed KMS key to encrypt environment variables for an AWS Lambda function. What must be configured to allow Lambda to decrypt the environment variables at runtime?

   • AThe environment variables must be base64-encoded before encryption.
   • BThe function must be configured with a VPC to access the KMS key.
   • CThe function's execution role must have kms:Decrypt permission for the customer-managed key.
   • DThe KMS key must be in the same AWS account as the Lambda function.
   Reveal Solution Discussion Select an answer first