Question 669 of 724
DVA-C02 Security Practice Question
A developer needs to allow an EC2 instance to read from a DynamoDB table. Which is the best practice to grant permissions?
⚠ Common exam trap
It's easy for candidates to confuse security groups (network-level access control) with IAM policies (identity-based access control) and incorrectly think adding a DynamoDB table ARN to a security group can grant data access, when in fact security groups only control network traffic and cannot authorize API calls to DynamoDB.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role with the required permissions and attach it to the EC2 instance.
The best practice for granting an EC2 instance permissions to access DynamoDB is to create an IAM role with the required permissions and attach it to the instance. This eliminates the need to manage long-term credentials, as the instance automatically retrieves temporary security credentials from the instance metadata service (IMDS) via the AWS Security Token Service (STS). This approach follows the principle of least privilege and ensures credentials are rotated automatically.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Create an IAM role with the required permissions and attach it to the EC2 instance.
Why this is correct
Attaching an IAM role to an EC2 instance is the recommended and most secure method for granting AWS service permissions. This approach leverages temporary credentials automatically provided to the instance via the EC2 instance metadata service, eliminating the need to store static, long-term credentials on the instance itself. The role defines specific permissions, such as dynamodb:GetItem or dynamodb:Query, allowing the EC2 instance to interact with DynamoDB securely and with the principle of least privilege.
- ✗
Generate an IAM user access key and store it in the application configuration.
Why it's wrong here
Generating an IAM user access key and storing it in application configuration is an insecure practice. These static credentials, if compromised, grant persistent access to AWS resources and are difficult to rotate or revoke quickly across multiple instances. This method bypasses the secure credential management provided by IAM roles and increases the attack surface, making the application vulnerable to unauthorized access.
- ✗
Hardcode the AWS credentials in the application code.
Why it's wrong here
Hardcoding AWS credentials directly into the application code is a critical security vulnerability and an anti-pattern. These static credentials become embedded within the application binary or source code, making them discoverable if the code repository is breached or the application is decompiled. This approach also makes credential rotation extremely difficult, requiring code changes and redeployments across all instances, which is impractical and error-prone.
- ✗
Add the DynamoDB table ARN to the EC2 instance's security group.
Why it's wrong here
Adding a DynamoDB table ARN to an EC2 instance's security group is incorrect because security groups operate at the network layer, controlling inbound and outbound traffic to and from the instance. They define firewall rules based on IP addresses, ports, and protocols, but do not provide authorization to interact with AWS services like DynamoDB. Access to AWS services is governed by IAM policies, not network security configurations.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.