DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Static credentials committed to Git

  Why it's wrong here

  Committing static credentials, such as AWS access key IDs and secret access keys, directly to a version control system like Git is a severe security anti-pattern. This practice exposes sensitive information to anyone with repository access, creating a significant risk of credential compromise and unauthorized access to AWS resources. It completely bypasses secure credential management best practices and is highly discouraged for any production environment.

• ✗

  A credentials file copied into the AMI

  Why it's wrong here

  Copying a static credentials file (e.g., ~/.aws/credentials) directly into an Amazon Machine Image (AMI) embeds long-lived access keys into every instance launched from that image. This approach makes credential rotation cumbersome and increases the blast radius if an instance or the AMI itself is compromised. It lacks the dynamic, temporary nature and centralized management benefits provided by IAM roles, making it an insecure and inflexible method.

• ✗

  The root account access key

  Why it's wrong here

  Using the AWS account root user access key for programmatic access from an EC2 instance is an extremely dangerous security practice that grants unrestricted administrative privileges across the entire AWS account. The compromise of these credentials would provide an attacker with full control over all resources, leading to potentially catastrophic security breaches. AWS best practices strongly recommend against using root user credentials for any routine programmatic operations, reserving them only for a few critical account management tasks.

• ✓

  Temporary credentials from the instance profile role

  Why this is correct

  Attaching an IAM role to an EC2 instance via an instance profile is the recommended and most secure method for granting AWS API access to applications running on that instance. This mechanism automatically provides temporary, frequently rotated credentials to the instance metadata service, which applications can retrieve without needing to store any long-term static keys. This significantly enhances security, simplifies credential management, and adheres to the principle of least privilege by allowing granular permissions.