DVA-C02 Security Practice Question
A developer is creating an IAM policy for an EC2 instance to allow it to read from an S3 bucket. Which of the following are required? (Choose TWO.)
⚠ Common exam trap
A common mix-up: candidates think an S3 bucket policy is always required when using an IAM role, but it is only necessary for cross-account access or when the bucket policy explicitly restricts access; for same-account access, the role's permissions alone are sufficient.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role with s3:GetObject permissions
An IAM role is the recommended way to grant temporary, secure credentials to an EC2 instance for accessing AWS services. The s3:GetObject permission allows the instance to read objects from an S3 bucket, which is the specific action required for read access.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM role with s3:GetObject permissions
Why this is correct
An IAM role is the fundamental identity construct used to grant permissions to AWS services, including EC2 instances. Creating an IAM role with the specific `s3:GetObject` permission ensures that the EC2 instance is authorized to retrieve objects from an S3 bucket, adhering to the principle of least privilege by granting only the necessary read access for the intended operation.
- ✗
Use KMS to encrypt the S3 objects
Why it's wrong here
While encrypting S3 objects with AWS Key Management Service (KMS) is a robust security measure for data at rest, it is not a prerequisite for an EC2 instance to access those objects. The ability to retrieve an S3 object is governed by the IAM permissions granted to the accessing entity, not by the encryption method used. KMS encryption primarily protects data confidentiality, not the authorization to access it.
- ✗
Configure an S3 bucket policy allowing the role
Why it's wrong here
An S3 bucket policy is typically employed for cross-account access scenarios, to grant public access, or to define permissions for specific AWS services not directly associated with an IAM role. When the EC2 instance and the S3 bucket reside within the same AWS account, the permissions granted directly to the IAM role attached to the EC2 instance are sufficient for access, rendering a separate S3 bucket policy redundant and unnecessary for this specific use case.
- ✓
Attach the IAM role to the EC2 instance
Why this is correct
After an IAM role with the appropriate permissions (e.g., `s3:GetObject`) has been created, it must be explicitly attached to the target EC2 instance. This critical step associates the instance with the role's security context, allowing applications running on that EC2 instance to assume the role and inherit its defined permissions. Without this attachment, the instance lacks the necessary authorization to perform any S3 operations.
- ✗
Create an instance profile and assign a key pair
Why it's wrong here
An instance profile is an AWS container for an IAM role that allows an EC2 instance to assume that role, and it is automatically created when an IAM role is assigned to an EC2 instance. Assigning a key pair, however, is solely for establishing secure SSH access to the EC2 instance itself and has no bearing on the instance's permissions to interact with other AWS services like S3. These are distinct security mechanisms serving different purposes.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.