DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  An EC2 instance can have multiple IAM roles attached simultaneously.

  Why it's wrong here

  An EC2 instance can only have one instance profile associated with it, and that profile can contain exactly one IAM role. You cannot attach multiple IAM roles simultaneously; instead, you must combine all required permissions into a single role's policy. Swapping roles requires replacing the instance profile on the instance, not attaching an additional one.

• ✓

  Temporary security credentials are obtained from the instance metadata service.

  Why this is correct

  When an EC2 instance uses an IAM role, the AWS SDK automatically retrieves temporary security credentials from the EC2 Instance Metadata Service at 169.254.169.254/latest/meta-data/iam/security-credentials/. These credentials are signed with STS and include an AccessKeyId, SecretAccessKey, and Token, and the SDK caches and refreshes them without any access key management on your part.

• ✗

  The temporary credentials expire after 6 hours and must be manually refreshed.

  Why it's wrong here

  Temporary credentials obtained from an IAM role have a configurable session duration (default 6 hours, max 6 hours for EC2), but the AWS SDK does not require manual refresh. The SDK detects expiration and transparently calls the instance metadata service to receive a new set of credentials. Behind the scenes, the EC2 service also periodically rotates these credentials, so no human intervention is needed.

• ✗

  An IAM role can only be attached to one EC2 instance at a time.

  Why it's wrong here

  An IAM role is not tied to a single instance. The role is contained in an instance profile, and a single instance profile can be associated with many EC2 instances at the same time. Thus, the same IAM role can be used by hundreds of instances concurrently, with each instance getting its own STS session through the metadata service.

• ✓

  An IAM role can be attached to a running EC2 instance without stopping it.

  Why this is correct

  You can associate or replace an IAM instance profile on a running EC2 instance without stopping or rebooting it. Using the AWS CLI or Management Console, operations like associate-iam-instance-profile apply the profile immediately, and new processes that fetch credentials will then receive the new role's permissions. This allows you to change access rights on live instances for temporary needs or privilege adjustments.

Go deeper

Related to this question