DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Rotate IAM user access keys periodically.

  Why this is correct

  IAM user access keys are long-term credentials that remain valid until explicitly deactivated or deleted. Periodic rotation—for example, via an automated script or the AWS Console—shrinks the exploit window should a key leak into source code or logs. AWS provides 'last used' information to help identify and prune stale keys, and rotating keys is a fundamental part of any credential management policy.

• ✓

  Grant least privilege permissions.

  Why this is correct

  Least privilege requires building IAM policies that grant only the exact actions and resources a principal needs, and ideally constraining them with conditions like source IP or time-of-day. AWS managed policies are convenient but often too broad; a custom policy scoped to a specific bucket or API action prevents a compromised user from escalating or accessing unrelated data. This minimizes the blast radius of leaked credentials.

• ✓

  Use IAM roles for EC2 instances instead of storing access keys.

  Why this is correct

  Assigning an IAM role to an EC2 instance lets the instance retrieve temporary credentials from the instance metadata service, removing the need to store access keys on the instance or in code. These credentials are issued via STS and expire automatically, so even if an instance is compromised, the attacker cannot reuse exported keys. This eliminates the operational burden of distributing and rotating static keys across fleets.

• ✗

  Use the root account for daily administrative tasks.

  Why it's wrong here

  The root user has unrestricted access to every service and resource in the account, and AWS recommends deleting root access keys and enabling multi-factor authentication for the root account. Performing daily administrative tasks as root violates that principle, exposing the account to catastrophic compromise if the root password is phished. Even break-glass account recovery should be a rare, tightly controlled event.

• ✗

  Assign full administrator access to all users.

  Why it's wrong here

  Attaching a policy that grants wildcard actions ("Action:*") on all resources gives every user the ability to modify IAM, delete data, or create expensive services. Such broad permissions mean a single stolen credential can lead to account takeover or a massive billing shock. Admin privileges should be reserved for a small break-glass group, and all routine work should be confined to narrowly scoped policies.

Go deeper

Related to this question