DVA-C02 Security Practice Question
Which THREE are valid methods to authenticate to AWS APIs? (Choose 3)
⚠ Common exam trap
DVA-C02 often tests the difference between AWS API authentication and other service-specific credentials; candidates may incorrectly select CloudFront key pairs or database passwords because they are AWS-related, but they do not authenticate to AWS APIs.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Temporary security credentials from AWS STS
Option A is correct because AWS STS issues temporary security credentials (access key ID, secret access key, and session token) via APIs like AssumeRole, GetSessionToken, or GetFederationToken, and these credentials are accepted by AWS APIs for signing requests with SigV4. Option C is correct because an EC2 instance profile delivers temporary IAM role credentials to the instance through the Instance Metadata Service (IMDS), which the AWS SDK and CLI automatically use to sign API calls. Option E is correct because a long-term IAM user access key ID and secret access key are the classic SigV4 signing credentials used to authenticate programmatic requests to AWS APIs. Option B is not a valid AWS API authentication method because a database password in Secrets Manager is a secret for connecting to a database, not an AWS credential, even though Secrets Manager itself is accessed using AWS credentials. Option D is not valid because a CloudFront key pair is used to create signed URLs or signed cookies for private content distribution, not to authenticate requests to AWS service APIs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Temporary security credentials from AWS STS
Why this is correct
Temporary security credentials from AWS STS are a valid authentication method because they provide short-lived access keys plus a session token that are used with Signature Version 4 to sign AWS API calls. These credentials are obtained by calling AssumeRole, GetFederationToken, or related STS APIs, and they are ideal for federated users, cross-account roles, and scenarios requiring limited-time access. The session token is mandatory when signing requests with these credentials.
- ✗
Database password stored in Secrets Manager
Why it's wrong here
A database password stored in AWS Secrets Manager is not valid for authenticating to AWS APIs because it is simply a secret value intended for logging into a database system, not an IAM credential. It lacks the access key ID, secret access key, and optional session token required for Signature Version 4 signing. Even if you retrieve the secret programmatically, you cannot use it to sign an AWS API request; it must be used with a database client over its own authentication protocol.
- ✓
Credentials from an EC2 instance profile
Why this is correct
Credentials from an EC2 instance profile are a valid authentication method because the IAM role attached to the instance provides temporary credentials through the instance metadata service (IMDSv1/v2). The SDK automatically retrieves and rotates these credentials, eliminating long-term static access keys on the instance. These credentials are scoped to the role's permissions and are used with a session token when signing AWS API calls, making them secure and operationally convenient for applications on EC2.
- ✗
CloudFront key pair
Why it's wrong here
A CloudFront key pair is not a valid method for authenticating to AWS APIs because it serves an entirely different purpose: it is used to create signed URLs or signed cookies for controlling access to private CloudFront-distributed content. This key pair works with CloudFront's own signature verification mechanism, not with AWS Signature Version 4 used for API authentication. Possessing a CloudFront key pair does not grant any identity or permissions in IAM, so it cannot authenticate AWS API requests.
- ✓
IAM user access key ID and secret access key
Why this is correct
IAM user access key ID and secret access key are a valid and standard method for programmatic authentication to AWS APIs. These are long-term credentials that, when paired, are used to calculate a Signature Version 4 HMAC signature for each request. They are associated with an IAM user and inherit the permissions attached to that user via IAM policies. While valid, they must be securely stored and regularly rotated, as they do not expire and can be a security risk if leaked.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.