DVA-C02 Security Practice Question
A developer needs to generate temporary credentials for a user to access an S3 bucket for 30 minutes. Which AWS service should be used?
⚠ Common exam trap
A common mix-up: candidates confuse IAM roles (a permission container) with the service that actually issues temporary credentials (STS), leading them to select Option A instead of D.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Security Token Service (STS)
AWS Security Token Service (STS) is the correct service for generating temporary, limited-privilege credentials to access AWS resources. It can issue credentials with a configurable expiration period, such as 30 minutes, via the AssumeRole API call. This directly meets the requirement for time-bound access to an S3 bucket.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
IAM role
Why it's wrong here
An IAM role is an AWS identity with permission policies that determine what actions the identity can perform on AWS resources. While a developer would assume an IAM role to gain specific, predefined permissions for a task, the role itself does not generate temporary credentials. Instead, it defines the permissions and trust policy that allow a principal, via a service like AWS STS, to obtain temporary credentials for a session.
- ✗
Amazon Cognito
Why it's wrong here
Amazon Cognito issues tokens for identity federation and user authentication, not temporary AWS credentials with a configurable 30-minute expiry for direct S3 access. It is tempting because it manages user sign-in and can exchange identity tokens for AWS credentials via an identity pool, which would be correct for a mobile app requiring authenticated, short-term S3 access after login.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
AWS Key Management Service (KMS) is a managed service designed to create and control encryption keys used to encrypt data across various AWS services and applications. Its primary function is cryptographic key management, including key generation, storage, and usage tracking for data at rest and in transit. KMS has no functionality for generating temporary security credentials for authenticating to AWS services or assuming IAM roles; it is purely for cryptographic operations.
- ✓
AWS Security Token Service (STS)
Why this is correct
AWS Security Token Service (STS) is the dedicated AWS service for creating and providing temporary, limited-privilege credentials for AWS users, federated users, or applications. Developers utilize STS API operations like AssumeRole, GetFederationToken, or GetSessionToken to obtain these credentials, which consist of an access key ID, a secret access key, and a session token. These temporary credentials can be configured with a specific duration, such as 30 minutes, making them ideal for secure, short-lived access to AWS resources.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.