CLF-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store the AWS access key ID and secret access key in a configuration file on the instance's local disk.

  Why it's wrong here

  Embedding an access key ID and secret access key in a configuration file on the instance stores permanent static credentials that do not expire and would require manual rotation to maintain security. If the instance is compromised, the attacker can copy those keys and use them from anywhere, directly violating the security policy's requirement to avoid storing long-term credentials on the instance. Even if the configuration file is encrypted on disk, the application must decrypt it into memory at runtime, creating an attack surface that the IAM role approach eliminates.

  When this WOULD be correct

  If the question explicitly allowed storing long-term credentials and required a simple, direct method to provide access without setting up IAM roles or instance profiles, storing credentials in a configuration file would be a straightforward solution.

• ✓

  Create an IAM role with the required S3 read permissions. Attach the role to the EC2 instance profile.

  Why this is correct

  An IAM role is the recommended identity for an EC2 application because the instance assumes the role through its instance profile, and the AWS SDK retrieves temporary credentials from the EC2 instance metadata service (IMDS). These credentials are issued by AWS STS, are valid for a limited session, and are automatically rotated before expiry, so the application never handles a long-lived secret. Attaching the role to the instance profile and allowing the application to use the SDK's default credential chain gives the instance exactly the S3 read permissions scoped by the role's policy.

• ✗

  Write a resource-based policy on the S3 bucket that allows access based on the private IP address of the EC2 instance.

  Why it's wrong here

  S3 bucket policies can use the aws:SourceIp condition, but that condition expects public IP addresses, not private IPs. Since the instance is in a private subnet without a public IP, this policy would not grant access. Additionally, IP-based authorization alone is not a secure replacement for IAM credentials.

  When this WOULD be correct

  If the question required granting cross-account access to an S3 bucket without using IAM roles, and the EC2 instance had a static public IP (Elastic IP) in a VPC with a VPC endpoint, a bucket policy with aws:SourceIp condition could be used, but only for public IPs, not private.

• ✗

  Create a new IAM user with the required permissions. Store the IAM user's access key and secret key in AWS Systems Manager Parameter Store, and configure the application to retrieve them at runtime.

  Why it's wrong here

  Although this method separates credentials from the code, it still uses long-term IAM user access keys. These are static secrets that can be leaked if Parameter Store access is compromised. The IAM role approach is more secure because it uses temporary credentials that are automatically rotated.

  When this WOULD be correct

  If the question required using temporary credentials but the instance cannot use an IAM role (e.g., the instance is not in EC2 or is in an on-premises environment), then storing access keys in Parameter Store and retrieving them at runtime would be a valid solution to avoid hardcoding credentials.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question