DVA-C02 Security Practice Question
A developer is using IAM roles for Amazon EC2 to grant permissions to an application. The application makes API calls to DynamoDB and S3. After deploying, the application fails to access DynamoDB. The developer verifies the IAM role has the correct DynamoDB permissions. What is the most likely cause?
⚠ Common exam trap
Test-takers frequently assume simply having the correct IAM role with proper permissions is sufficient, overlooking the mandatory step of attaching the role to an EC2 instance profile for credential delivery.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IAM role is not attached to the EC2 instance profile.
For an EC2 instance to use an IAM role, the role must be attached to an EC2 instance profile, which is the container that passes the role's credentials to the instance via the instance metadata service. Even if the IAM role has the correct DynamoDB permissions, if it is not associated with the instance profile, the application will not receive temporary credentials and will fail to access DynamoDB.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The IAM role does not have a trust policy for EC2.
Why it's wrong here
A trust policy defines which AWS entities are permitted to assume an IAM role. If the EC2 instance were unable to assume the role due to a missing or incorrect trust policy for the `ec2.amazonaws.com` service principal, then *all* attempts to access AWS services using that role, including the successful S3 access, would fail with an `AccessDenied` error. The fact that S3 access works confirms the trust policy is correctly configured for EC2.
- ✓
The IAM role is not attached to the EC2 instance profile.
Why this is correct
An IAM role cannot be directly attached to an EC2 instance; it must be associated via an Instance Profile. The Instance Profile acts as a container for the IAM role, making its temporary credentials available to applications running on the EC2 instance through the instance metadata service. If the IAM role is not correctly embedded within an Instance Profile and that profile is not attached to the EC2 instance, the application will lack the necessary credentials to assume the role and perform actions like accessing DynamoDB.
- ✗
The DynamoDB table is in a different region than the EC2 instance.
Why it's wrong here
AWS services like DynamoDB are designed to support cross-region access, provided the application explicitly configures the AWS SDK to target the correct region. If the DynamoDB table were in a different region and the application failed to specify it, the error would typically manifest as a `ResourceNotFoundException` or similar, indicating the table could not be located in the default or specified region, rather than an `AccessDeniedException` related to IAM permissions.
- ✗
The application is using the wrong AWS SDK.
Why it's wrong here
Using a different or outdated AWS SDK version might lead to issues such as incompatible API calls, serialization errors, or missing features, but it does not fundamentally alter the underlying IAM permissions granted by a role. The SDK's role is to facilitate interaction with AWS services and automatically retrieve credentials from the instance metadata service. Permission failures stem from the IAM policy itself or the role's attachment mechanism, not the SDK version used.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.