DVA-C02 Development with AWS Services Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  IAM: Controls access to AWS services and resources for users and roles.

  Why this is correct

  IAM provides fine-grained access control by letting you create users, groups, and roles and attach JSON policies that explicitly allow or deny actions on AWS resources. It manages both authentication, through credentials, MFA, or federated identities, and authorization, including temporary credentials via AWS STS. This capability is what makes IAM the core service for securely controlling access across an AWS account.

• ✓

  Security Groups: Acts as a virtual firewall for EC2 instances.

  Why this is correct

  A security group is a stateful virtual firewall that operates at the elastic network interface (ENI) level of an EC2 instance. It contains inbound and outbound rules that allow specific traffic based on protocol, port, and source or destination CIDRs or security group IDs, and it evaluates all rules before allowing traffic—unmatched traffic is implicitly denied. Because it is stateful, returning traffic is automatically allowed regardless of outbound rules.

• ✓

  KMS: Creates and manages encryption keys.

  Why this is correct

  AWS Key Management Service (KMS) is a managed service that creates, stores, rotates, and deletes cryptographic keys used to encrypt data across AWS services. It uses KMS keys and supports envelope encryption, where a data key encrypts your data and the KMS key encrypts that data key, enabling centralized key management and integration with CloudTrail for audit. KMS also integrates with IAM for key usage permissions.

• ✓

  CloudTrail: Records API activity in your AWS account.

  Why this is correct

  AWS CloudTrail is a governance and auditing service that continuously logs all API activity in your AWS account, recording details such as who made the call, the source IP, service, resource, and timestamp. These event logs help with security analysis, operational troubleshooting, and compliance reporting, and they can be delivered to S3 or CloudWatch Logs. Recording API activity is therefore the function of CloudTrail, not IAM.

• ✗

  IAM: Records API activity in your AWS account.

  Why it's wrong here

  IAM is an identity and access management service, not an audit log. Recording API activity is the purpose of AWS CloudTrail, which captures user requests and API calls for governance and compliance. IAM instead defines who can sign in (authentication) and what actions they may perform (authorization) via policies attached to users, groups, and roles.

• ✗

  Security Groups: Controls network traffic at the subnet level.

  Why it's wrong here

  The statement is incorrect because security groups are evaluated at the instance/ENI level, not the subnet level. Subnet-wide traffic filtering is the job of Network Access Control Lists (NACLs), which are stateless and support both allow and deny rules. Security groups are stateful and only support allow rules, and they filter traffic for resources they are attached to, like EC2 instances.

Go deeper

Related to this question