DVA-C02 Security Practice Question
Which THREE are best practices for managing IAM users and roles? (Choose three.)
⚠ Common exam trap
DVA-C02 often tests the misconception that root account usage or broad admin access is acceptable for convenience, when AWS best practice strictly prohibits both.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Rotate IAM user access keys periodically.
Option A is correct because periodically rotating IAM user access keys limits the window of exposure if a key is compromised, and AWS best practices recommend key rotation (for example, via the IAM console or aws iam create-access-key/update-access-key/delete-access-key). Option B is correct because granting least privilege means attaching only the minimal IAM policies and permissions required for a principal's task, reducing the blast radius of accidental or malicious actions. Option C is correct because EC2 instances should assume an IAM role through instance profiles and the Instance Metadata Service (IMDS) to obtain temporary credentials via AWS STS, eliminating long-lived access keys stored on the instance. Option D is not correct because the root account should be used only for a few account-level tasks, protected with MFA, and never for daily administration. Option E is not correct because assigning full administrator access to all users violates least privilege and dramatically increases security risk.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Rotate IAM user access keys periodically.
Why this is correct
IAM user access keys are long-term credentials that remain valid until explicitly deactivated or deleted. Periodic rotation—for example, via an automated script or the AWS Console—shrinks the exploit window should a key leak into source code or logs. AWS provides 'last used' information to help identify and prune stale keys, and rotating keys is a fundamental part of any credential management policy.
- ✓
Grant least privilege permissions.
Why this is correct
Least privilege requires building IAM policies that grant only the exact actions and resources a principal needs, and ideally constraining them with conditions like source IP or time-of-day. AWS managed policies are convenient but often too broad; a custom policy scoped to a specific bucket or API action prevents a compromised user from escalating or accessing unrelated data. This minimizes the blast radius of leaked credentials.
- ✓
Use IAM roles for EC2 instances instead of storing access keys.
Why this is correct
Assigning an IAM role to an EC2 instance lets the instance retrieve temporary credentials from the instance metadata service, removing the need to store access keys on the instance or in code. These credentials are issued via STS and expire automatically, so even if an instance is compromised, the attacker cannot reuse exported keys. This eliminates the operational burden of distributing and rotating static keys across fleets.
- ✗
Use the root account for daily administrative tasks.
Why it's wrong here
The root user has unrestricted access to every service and resource in the account, and AWS recommends deleting root access keys and enabling multi-factor authentication for the root account. Performing daily administrative tasks as root violates that principle, exposing the account to catastrophic compromise if the root password is phished. Even break-glass account recovery should be a rare, tightly controlled event.
- ✗
Assign full administrator access to all users.
Why it's wrong here
Attaching a policy that grants wildcard actions ("Action:*") on all resources gives every user the ability to modify IAM, delete data, or create expensive services. Such broad permissions mean a single stolen credential can lead to account takeover or a massive billing shock. Admin privileges should be reserved for a small break-glass group, and all routine work should be confined to narrowly scoped policies.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.