2.0 Security DVA-C02 Practice Quiz
130 exam-style questions covering 26% of the DVA-C02 exam. Instant feedback on every answer, progress tracking, no signup required.
This domain is part of the AWS Certified Developer Associate practice test. Each question is tagged by exam objective and difficulty so you can drill exactly the areas you need.
Sample Questions
A web application must let employees sign in with a corporate SAML identity provider and receive temporary access to AWS-backed application resources. Which approach fits?
- A. Use Amazon Cognito federation with the corporate identity provider
- B. Create IAM users for every employee
- C. Store corporate passwords in DynamoDB
- D. Use an API Gateway usage plan as the identity provider
Amazon Cognito can federate users from a SAML identity provider and issue tokens that the application can use for authenticated access. This is the correct answer.
A developer wants application users to authenticate through a social provider but keep authorization decisions in the application. Which split is appropriate?
- A. Use the identity provider for authentication and application logic for authorization
- B. Use S3 bucket ACLs as the user login system
- C. Treat every authenticated user as an administrator
- D. Use KMS encryption context as the user directory
The identity provider proves who the user is; the application can still enforce resource-level decisions from claims and its own data. This is the correct answer.
A mobile app needs users to sign in with Google and then access AWS resources through temporary credentials. Which service can broker this flow?
- A. IAM access keys embedded in the app
- B. Amazon Cognito identity pools
- C. AWS STS without an identity provider relationship
- D. Secrets Manager secret rotation
Cognito identity pools can exchange authenticated identities from supported providers for temporary AWS credentials. This is the correct answer.
An application uses Cognito groups to place users into Admin and Viewer categories. What should the backend check?
- A. The user's plaintext password
- B. Group or role claims in the validated token
- C. The API Gateway deployment ID
- D. The Lambda function memory size
Cognito group membership can appear in token claims, letting the backend enforce role-specific behavior after token validation. This is the correct answer.
A developer stores an access token in browser local storage and is concerned about XSS exposure. Which mitigation is relevant?
- A. Increase DynamoDB read capacity
- B. Use secure token storage patterns and reduce script exposure
- C. Use a longer SQS visibility timeout
- D. Add a Lambda layer for logging only
Bearer tokens can be used by anyone who obtains them, so storage choices and XSS defenses directly affect token safety. This is the correct answer.
A customer-facing app must support sign-up, sign-in, and JWT issuance without building a user directory from scratch. Which feature should be used?
- A. IAM group with console password policy
- B. AWS KMS customer managed key
- C. Amazon Cognito user pool
- D. SQS FIFO queue for login requests
A Cognito user pool provides managed user registration, authentication, and token issuance for application users. This is the correct answer.
A federation setup fails because tokens are issued for a different application client. Which token field is most relevant?
- A. SQS message group ID
- B. DynamoDB partition key
- C. Audience or client ID claim
- D. Lambda layer ARN
The audience or client ID claim identifies the intended application client and must match what the API trusts. This is the correct answer.
An API should accept tokens from an OpenID Connect provider. What should validate the token before business logic runs?
- A. Lambda reserved concurrency
- B. DynamoDB conditional write
- C. CloudFront origin request policy
- D. A JWT authorizer or Cognito authorizer on the API
An API authorizer can validate token issuer, audience, signature, and claims before the backend handler is invoked. This is the correct answer.
Key Terms in This Domain
- AWS IAM: Identity and access management for AWS resources
- S3 SSE-S3: Server-side encryption with S3-managed keys
- S3 SSE-KMS: Server-side encryption with customer-managed KMS keys
- S3 SSE-C: Server-side encryption with customer-provided keys
- S3 client-side encryption: Encrypt data on the client before upload
- Elastic Load Balancing: Distribute incoming traffic across application targets
- Amazon Cognito identity pools: Federated identities mapped to temporary AWS credentials
- AWS KMS: Managed key management for encryption at rest and in transit
- Bearer token: Token presented by the client (e.g., JWT) that grants access if valid
- Client-side encryption: Caller encrypts data before sending it to AWS
Link to this quiz
Studying with a group or teaching a class? Send this address or paste the link into your notes, wiki, or course page:
https://quizbuffet.com/aws-developer-associate/security/
<a href="https://quizbuffet.com/aws-developer-associate/security/">AWS Certified Developer Associate Security practice quiz on QuizBuffet</a>
Other DVA-C02 Domains
← Back to DVA-C02 practice test overview
Questions are written against the published DVA-C02 objectives and checked for accuracy and balance before they go live. How QuizBuffet writes and reviews its questions.