DVA-C02 Development with AWS Services Practice Question
A company uses AWS Elastic Beanstalk to deploy a web application. The application stores user-uploaded images in an S3 bucket. The developer needs to ensure that the application can read and write to the S3 bucket. What should the developer do?
⚠ Common exam trap
Candidates often confuse network-level controls (security groups) with identity-based controls (IAM roles) and incorrectly assume that an S3 bucket policy can reference a security group, when in fact S3 bucket policies support only principal, source IP, VPC, or source VPC endpoint conditions, not security group IDs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure the Elastic Beanstalk environment to use an IAM instance profile that grants S3 access.
Elastic Beanstalk environments run on EC2 instances, and the recommended way to grant AWS permissions to those instances is by attaching an IAM instance profile. This profile includes an IAM role with a policy that allows the required S3 read and write actions, enabling the application to securely access the S3 bucket without embedding credentials in the code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use Amazon CloudFront to proxy requests to the S3 bucket.
Why it's wrong here
Using Amazon CloudFront to proxy requests to an S3 bucket is primarily for content delivery and caching, optimizing read access for end-users. CloudFront does not provide a mechanism for an application running on Elastic Beanstalk to authenticate and perform write operations (like uploads or deletions) to S3. Its role is to serve content, not to grant programmatic access to AWS resources for backend applications.
- ✗
Hardcode the AWS access keys in the application code.
Why it's wrong here
Hardcoding AWS access keys directly into application code is a critical security anti-pattern. These static credentials, if exposed through source code repositories, logs, or compromised instances, grant full access to the associated AWS account's resources, violating the principle of least privilege. This practice makes credential rotation difficult and significantly increases the risk of unauthorized access and data breaches.
- ✗
Apply an S3 bucket policy that allows access from the Elastic Beanstalk environment's security group.
Why it's wrong here
S3 bucket policies are designed to control access based on IAM principals (users, roles, federated users) or specific IP addresses, not directly on EC2 security groups. While a security group manages network traffic rules for EC2 instances, it does not represent an identity that S3 can use for authorization decisions. Therefore, an S3 bucket policy cannot directly grant permissions to an Elastic Beanstalk environment's underlying EC2 instances based solely on their security group.
- ✓
Configure the Elastic Beanstalk environment to use an IAM instance profile that grants S3 access.
Why this is correct
Configuring the Elastic Beanstalk environment to use an IAM instance profile that grants S3 access is the recommended and most secure method. An IAM instance profile attaches an IAM role to the underlying EC2 instances, allowing the application to obtain temporary, automatically rotated credentials from the instance metadata service. This enables the application to make authenticated AWS API calls to S3 without storing any long-term credentials directly within the application code or configuration.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.