DVA-C02 Security Practice Question
A company uses an IAM role to allow an EC2 instance to access an S3 bucket. The role's trust policy allows the EC2 service, and the permissions policy grants s3:GetObject on the bucket. The application on the instance receives 'Access Denied' errors when trying to read objects. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently assume the IAM role's trust and permissions policies are sufficient, overlooking the mandatory instance profile association required for EC2 to use the role.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The EC2 instance does not have an instance profile associated with the IAM role.
The most likely cause is that the EC2 instance does not have an instance profile associated with the IAM role. An IAM role must be attached to an EC2 instance via an instance profile, which acts as a container for the role. Without this association, the instance cannot obtain temporary credentials from the AWS Security Token Service (STS) to sign API requests, resulting in 'Access Denied' errors even if the role's trust and permissions policies are correctly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IAM role's trust policy does not allow the EC2 service.
Why it's wrong here
The IAM role's trust policy defines which principals are allowed to assume the role. If the trust policy did not include "ec2.amazonaws.com" as a service principal, the EC2 service would indeed be unable to assume the role, preventing the instance from gaining permissions. However, the problem implies the role itself is correctly configured for EC2, suggesting the trust policy is not the root cause of the access issue in this scenario.
- ✗
The S3 bucket has default encryption enabled.
Why it's wrong here
Default encryption on an S3 bucket, such as Server-Side Encryption with S3-managed keys (SSE-S3), encrypts objects at rest but does not inherently block access for authorized users. When an authorized principal attempts to retrieve an object, S3 transparently decrypts it before returning it. Therefore, default encryption alone does not prevent an EC2 instance with appropriate permissions from accessing objects; it's a data protection mechanism, not an access control barrier.
- ✓
The EC2 instance does not have an instance profile associated with the IAM role.
Why this is correct
An EC2 instance requires an instance profile to assume an IAM role and obtain temporary security credentials. The instance profile acts as a container for the IAM role, allowing the EC2 instance to retrieve these credentials via its metadata service. Without an instance profile explicitly associated with the EC2 instance, the instance lacks the necessary mechanism to assume the designated IAM role, rendering it unable to acquire the permissions required to interact with other AWS services like S3.
- ✗
The S3 bucket policy explicitly denies s3:GetObject.
Why it's wrong here
While an explicit "Deny" statement in an S3 bucket policy would indeed override any "Allow" statement in an associated IAM role, effectively blocking access, this option is incorrect because the question implies the IAM role should grant access. If the bucket policy were the issue, the problem would stem from a conflict between the resource policy and the role's permissions, rather than the EC2 instance's inability to assume the role in the first place.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.