DVA-C02 Security Practice Question
An application in ECS Fargate needs to read a secret and decrypt it with KMS. Which two permissions/configurations are needed?
⚠ Common exam trap
Watch out — candidates often confuse EC2 instance profiles with ECS task roles, forgetting that Fargate is serverless and has no underlying EC2 host to attach an instance profile to.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Task role permissions for Secrets Manager access
The ECS task role is an IAM role that the Fargate task assumes to make AWS API calls. To read a secret from AWS Secrets Manager, the task role must have an IAM policy granting `secretsmanager:GetSecretValue` permission. Option D is correct because the secret is encrypted with a KMS key, so the task role also needs a KMS key policy or IAM permission that allows `kms:Decrypt` on that specific key.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the secret in the container image
Why it's wrong here
Storing secrets directly within a container image is a significant security vulnerability. Once embedded, the secret becomes part of an immutable artifact, discoverable by anyone with access to the image in the registry or on a host. This method also severely complicates secret rotation, as any change necessitates rebuilding and redeploying the entire image, which is operationally inefficient and insecure, failing to meet modern security best practices for dynamic applications.
- ✓
Task role permissions for Secrets Manager access
Why this is correct
Assigning an IAM Task Role to the ECS Fargate task and granting it `secretsmanager:GetSecretValue` permissions is the secure and recommended approach. This allows the application running within the container to programmatically retrieve the necessary secret from AWS Secrets Manager at runtime. This method ensures secrets are never hardcoded, facilitates centralized management and rotation, and adheres to the principle of least privilege by granting only the necessary access.
- ✗
An EC2 instance profile attached to the Fargate host
Why it's wrong here
ECS Fargate is a serverless compute engine where AWS manages the underlying infrastructure, meaning there are no user-managed EC2 instances to which an instance profile can be attached. Fargate tasks derive their permissions from an IAM Task Role, not an EC2 instance profile. Therefore, this option is fundamentally inapplicable to the Fargate launch type, as it relies on an infrastructure component that does not exist in a user-managed capacity.
- ✓
KMS key policy/IAM permission allowing decrypt for the task role
Why this is correct
Since the requirement states the application needs to "decrypt" the secret, it implies the secret is encrypted, likely using AWS Key Management Service (KMS). Therefore, in addition to Secrets Manager access, the ECS Task Role must also possess `kms:Decrypt` permissions on the specific KMS key used to encrypt the secret. This ensures the application can successfully decrypt and utilize the retrieved secret, completing the secure access pattern.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.