DVA-C02 Security Practice Question
An application running on EC2 needs to access an S3 bucket. The security team wants to avoid using long-term access keys. What is the most secure approach?
⚠ Common exam trap
A common mix-up: candidates confuse 'secure storage' (like Parameter Store or Secrets Manager) with 'no long-term credentials at all,' failing to recognize that an IAM role provides temporary credentials that are inherently more secure and require no key management on the instance.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Launch the EC2 instance with an IAM role that grants S3 access.
Assigning an IAM role to an EC2 instance allows the instance to obtain temporary security credentials from the AWS Security Token Service (STS) automatically via the instance metadata service. This eliminates the need to store, rotate, or manage long-term access keys, adhering to the security team's requirement for a credential-less approach. The IAM role's permissions policy grants the EC2 instance access to the S3 bucket, and the credentials are automatically rotated by AWS before they expire.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Generate an access key and secret key for an IAM user and store them on the instance.
Why it's wrong here
Storing static IAM user access keys and secret keys directly on an EC2 instance is a significant security risk. These long-term credentials, if compromised, grant persistent access to AWS resources, potentially leading to unauthorized data access or resource manipulation. Managing their secure rotation and distribution across multiple instances is also operationally complex and error-prone, making this an anti-pattern for secure AWS access.
- ✗
Create a new IAM user and store the credentials in S3 with bucket policies.
Why it's wrong here
Creating an IAM user and then storing its credentials *within S3* itself, even if protected by bucket policies, introduces a severe security vulnerability and a circular dependency. An attacker gaining access to the S3 bucket could retrieve the very credentials needed to access the bucket and other resources. Furthermore, this approach still relies on static, long-term access keys, which are inherently less secure and harder to manage than temporary credentials.
- ✗
Use AWS Systems Manager Parameter Store to store the credentials and retrieve them at runtime.
Why it's wrong here
While AWS Systems Manager Parameter Store provides secure storage for sensitive data like credentials, using it to store static IAM user access keys for an EC2 instance is not the most secure or recommended approach. This method still relies on long-term credentials, which require manual rotation and present a persistent target for compromise if exfiltrated. The EC2 instance would also need permissions to retrieve these parameters, adding another layer of access management.
- ✓
Launch the EC2 instance with an IAM role that grants S3 access.
Why this is correct
Launching an EC2 instance with an attached IAM role is the most secure and recommended method for granting AWS resource access. This approach leverages the instance metadata service to provide temporary, frequently rotated credentials to applications running on the instance. These credentials are never stored directly on the instance, eliminating the risk associated with static access keys and simplifying credential management and rotation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An application running on EC2 needs to access an S3 bucket. What is the most secure way to grant access?
easy- A.Generate an IAM user access key and store it in a file on the instance
- B.Use pre-signed URLs for each request
- C.Make the S3 bucket public
- ✓ D.Create an IAM role with S3 permissions and attach it to the EC2 instance
Why D: Using an IAM role attached to the EC2 instance is the most secure because it provides temporary credentials and avoids hardcoding keys. Option A (IAM user access key stored on the instance) is less secure as it exposes long-term credentials. Option B (pre-signed URLs) is not suitable for ongoing access due to short expiration. Option C (making the S3 bucket public) is insecure as it allows anyone to access the bucket.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.