DVA-C02 Security Practice Question
An application running on EC2 instances in an Auto Scaling group needs to access an S3 bucket. The security team wants to avoid storing long-term AWS credentials on the instances. Which approach should be used?
⚠ Common exam trap
Watch out — candidates often think storing credentials in Parameter Store or using Lambda to generate temporary credentials is more secure, but they overlook that an IAM role with an instance profile is the simplest and most secure method because it eliminates the need to handle credentials at all.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Create an IAM role and attach it to the EC2 instance profile.
It uses an IAM role attached to an EC2 instance profile, which allows the EC2 instances to automatically obtain temporary security credentials from the AWS Security Token Service (STS). This approach eliminates the need to store long-term credentials on the instances, as the credentials are rotated automatically and are retrieved via the instance metadata service (IMDS).
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the credentials in AWS Systems Manager Parameter Store and retrieve them in User Data.
Why it's wrong here
Storing long-term access keys (access key ID and secret access key) in AWS Systems Manager Parameter Store and retrieving them via User Data, while better than hardcoding directly, still relies on static, long-lived credentials. This approach necessitates manual rotation of these keys, which is cumbersome and prone to oversight, failing to leverage the automatic temporary credential rotation provided by IAM roles for EC2 instances.
- ✓
Create an IAM role and attach it to the EC2 instance profile.
Why this is correct
Attaching an IAM role to an EC2 instance via an instance profile is the recommended best practice. This allows applications running on the instance to automatically obtain temporary, frequently rotated security credentials from the EC2 instance metadata service. AWS SDKs and CLI tools are designed to seamlessly retrieve these credentials, eliminating the need to store or manage any long-term access keys directly on the instance, thereby significantly enhancing security.
- ✗
Use an AWS Lambda function to generate temporary credentials and pass them to the instances.
Why it's wrong here
While an AWS Lambda function can generate temporary credentials using AWS Security Token Service (STS), implementing a custom solution to securely generate and then pass these credentials to EC2 instances introduces significant operational complexity. This approach would require developing a robust, secure mechanism for credential distribution, rotation, and revocation, which is far more intricate and error-prone than utilizing the native IAM instance profile feature.
- ✗
Generate access keys for a dedicated IAM user and store them in a file on the AMI.
Why it's wrong here
Generating static access keys for an IAM user and embedding them directly into a file on the Amazon Machine Image (AMI) is a severe security anti-pattern. Every EC2 instance launched from this AMI would possess identical, long-term credentials. If these keys are ever compromised, an attacker gains persistent access, and rotating them requires rebuilding and redeploying the AMI across the entire Auto Scaling group, which is highly impractical and insecure.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.