DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Temporary security credentials from AWS STS

  Why this is correct

  Temporary security credentials from AWS STS are a valid authentication method because they provide short-lived access keys plus a session token that are used with Signature Version 4 to sign AWS API calls. These credentials are obtained by calling AssumeRole, GetFederationToken, or related STS APIs, and they are ideal for federated users, cross-account roles, and scenarios requiring limited-time access. The session token is mandatory when signing requests with these credentials.

• ✗

  Database password stored in Secrets Manager

  Why it's wrong here

  A database password stored in AWS Secrets Manager is not valid for authenticating to AWS APIs because it is simply a secret value intended for logging into a database system, not an IAM credential. It lacks the access key ID, secret access key, and optional session token required for Signature Version 4 signing. Even if you retrieve the secret programmatically, you cannot use it to sign an AWS API request; it must be used with a database client over its own authentication protocol.

• ✓

  Credentials from an EC2 instance profile

  Why this is correct

  Credentials from an EC2 instance profile are a valid authentication method because the IAM role attached to the instance provides temporary credentials through the instance metadata service (IMDSv1/v2). The SDK automatically retrieves and rotates these credentials, eliminating long-term static access keys on the instance. These credentials are scoped to the role's permissions and are used with a session token when signing AWS API calls, making them secure and operationally convenient for applications on EC2.

• ✗

  CloudFront key pair

  Why it's wrong here

  A CloudFront key pair is not a valid method for authenticating to AWS APIs because it serves an entirely different purpose: it is used to create signed URLs or signed cookies for controlling access to private CloudFront-distributed content. This key pair works with CloudFront's own signature verification mechanism, not with AWS Signature Version 4 used for API authentication. Possessing a CloudFront key pair does not grant any identity or permissions in IAM, so it cannot authenticate AWS API requests.

• ✓

  IAM user access key ID and secret access key

  Why this is correct

  IAM user access key ID and secret access key are a valid and standard method for programmatic authentication to AWS APIs. These are long-term credentials that, when paired, are used to calculate a Signature Version 4 HMAC signature for each request. They are associated with an IAM user and inherit the permissions attached to that user via IAM policies. While valid, they must be securely stored and regularly rotated, as they do not expire and can be a security risk if leaked.

Go deeper

Related to this question