DVA-C02 Security Practice Question
A company runs an application on Amazon EC2 instances that need to read data from an Amazon DynamoDB table. The developer must grant access to DynamoDB without storing any long-term credentials on the instance. Which approach should the developer use?
⚠ Common exam trap
It's easy for candidates to think resource-based policies (Option D) can grant access to EC2 instances, but DynamoDB resource-based policies only support principals like AWS accounts, IAM users, or IAM roles—not EC2 instances directly—and the correct mechanism for EC2 is always an IAM role attached to the instance profile.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use an IAM role and attach it to the EC2 instance profile.
Attaching an IAM role to an EC2 instance profile allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS) via the instance metadata service. This eliminates the need to store long-term credentials on the instance, adhering to the principle of least privilege and improving security posture.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the AWS access key and secret key in a configuration file.
Why it's wrong here
Storing AWS access keys and secret keys directly in a configuration file on an EC2 instance is a severe security vulnerability. These long-term credentials do not automatically rotate, meaning if the instance is compromised, the keys could be exfiltrated and used indefinitely by an attacker. This practice violates the principle of least privilege and introduces a significant risk of unauthorized access to AWS resources, making it highly insecure.
- ✓
Use an IAM role and attach it to the EC2 instance profile.
Why this is correct
Attaching an IAM role to an EC2 instance profile is the recommended and most secure method for granting AWS service access to applications running on EC2 instances. This mechanism provides temporary, automatically rotated credentials to the instance via the EC2 instance metadata service, eliminating the need to store any long-term static credentials on the instance itself. This approach adheres to the principle of least privilege, significantly reducing the attack surface and improving overall security posture by ensuring credentials are short-lived and not directly exposed.
- ✗
Use an IAM user and store credentials in AWS Secrets Manager.
Why it's wrong here
Using Secrets Manager to store IAM user credentials still requires the application to retrieve long-term access keys at runtime, which violates the requirement to avoid storing any long-term credentials on the instance. This approach is tempting because Secrets Manager is designed to securely rotate and manage secrets, and would be correct if the application needed to access external services that require static API keys rather than AWS service roles.
- ✗
Use the DynamoDB table's resource-based policy to allow the EC2 instance.
Why it's wrong here
DynamoDB tables do not support resource-based policies for granting access directly to an EC2 instance or any other principal. Access to DynamoDB resources is exclusively controlled through identity-based IAM policies attached to IAM users, groups, or roles, which define what actions a principal can perform on specific resources. Therefore, attempting to use a resource-based policy directly on a DynamoDB table for access control is technically incorrect and would not function as intended within the AWS security model.
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.