DVA-C02 Development with AWS Services Practice Question
A developer needs an S3 upload workflow where clients upload large files directly to S3 without exposing AWS credentials through the browser. What should the backend generate?
⚠ Common exam trap
Many candidates confuse pre-signed URLs with public bucket policies or long-lived keys, thinking that any form of direct access requires exposing credentials, when in fact pre-signed URLs provide temporary, scoped access without credential leakage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Pre-signed URLs with appropriate expiration and object restrictions
Pre-signed URLs allow the backend to generate time-limited, permission-restricted URLs that clients can use to upload objects directly to S3 without exposing AWS credentials. The backend signs the URL with IAM credentials, and the client uses the URL to perform the PUT operation, ensuring secure, credential-free uploads.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Pre-signed URLs with appropriate expiration and object restrictions
Why this is correct
Pre-signed URLs grant temporary, time-limited access to specific S3 objects or prefixes without requiring AWS credentials directly from the client. They are generated by an AWS credential holder and can be configured with specific permissions (e.g., PutObject), an expiration time, and even conditions on the upload like content type or size. This approach securely delegates upload capability to unauthenticated clients for a defined period, aligning perfectly with the requirement for client uploads without exposing long-term credentials.
- ✗
Long-lived IAM access keys for each client
Why it's wrong here
Providing long-lived IAM access keys directly to each client is a significant security risk and an anti-pattern for client-side operations. These keys grant persistent programmatic access to AWS resources and, if compromised, could lead to unauthorized access and data breaches far beyond the intended S3 upload. Managing and rotating individual keys for potentially many clients would also be an operational burden, making it an insecure and impractical solution for a general client upload workflow.
- ✗
A public-read bucket policy
Why it's wrong here
A public-read bucket policy would allow anyone on the internet to read objects from the S3 bucket, but it does not inherently grant permissions for uploading objects (s3:PutObject). Furthermore, making a bucket publicly readable is generally discouraged unless explicitly required for static website hosting or public data distribution, as it exposes all stored data. It fails to address the upload requirement securely and introduces unnecessary public access to data.
- ✗
An S3 Inventory report
Why it's wrong here
An S3 Inventory report provides a flat file list of objects in a bucket or prefix, along with their metadata, for auditing and analysis purposes. It is a management feature used to understand the contents of an S3 bucket, not a mechanism for clients to upload new objects. This option is entirely unrelated to facilitating client uploads and serves a completely different operational function within S3.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.