Exams / DVA-C02 / Secrets and sensitive data / Question 3
DVA-C02 practice question: Secrets and sensitive data (3 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A multi-tenant mobile app stores user data in a DynamoDB table whose partition key is the user's Amazon Cognito identity ID. Users get temporary credentials from a Cognito identity pool. The role for signed-in users has this condition on a statement that allows GetItem, Query, PutItem and UpdateItem on the table:
"Condition": {
"ForAllValues:StringEquals": {
"dynamodb:LeadingKeys": ["${cognito-identity.amazonaws.com:sub}"]
}
}
What does this condition achieve?
Choose one answer.
- AA. It lets each user read every item, but write only items that they created.
- BB. It limits each user to items whose partition key equals their own Cognito identity ID.
- CC. It encrypts each user's items with a key derived from their Cognito identity ID.
- DD. It allows users to access only the attributes named in their Cognito user profile.
Show the answer and explanation
Answer: B
- A. Wrong: The condition applies to all the listed actions, reads included, so users cannot read other users' items either.
- B. Right: Correct. LeadingKeys is the partition key value being accessed, and the policy variable is replaced with the caller's identity ID.
- C. Wrong: IAM conditions control access. They do not encrypt data.
- D. Wrong: Restricting attributes needs the dynamodb:Attributes condition key. LeadingKeys restricts which partition key values can be used.
Explanation
Fine-grained access control in DynamoDB uses IAM condition keys. dynamodb:LeadingKeys matches the partition key of the items in the request, and a policy variable such as ${cognito-identity.amazonaws.com:sub} is replaced with the caller's identity. Together they keep each tenant's data separate without application code. Scan is left out because it reads all items regardless of the partition key.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.