DVA-C02 Security Practice Question
Which TWO are features of AWS Identity and Access Management (IAM)? (Choose 2)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Define fine-grained permissions with policies
Options C and E are correct. IAM allows you to define fine-grained permissions using policies (C) and create and manage users and groups (E). Option A is incorrect because encrypting S3 objects is a feature of S3, not IAM. Option B is incorrect because monitoring network traffic is typically done by VPC flow logs or CloudTrail, not IAM. Option D is incorrect because managing EC2 instance lifecycle is an EC2 function, not IAM.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt S3 objects automatically
Why it's wrong here
IAM does not perform data-plane encryption. Server-side encryption for S3 objects is handled by S3 itself using SSE-S3, SSE-KMS, or SSE-C, where KMS provides the cryptographic keys. IAM only governs who is authorized to call the encryption-related APIs (e.g., s3:PutObject) or to use a KMS key, not the actual encryption of stored data.
- ✗
Monitor network traffic
Why it's wrong here
IAM is an identity and access management service; it authenticates principals and authorizes API calls, but it does not inspect or monitor network traffic. Network-level observability is provided by services like VPC Flow Logs, AWS CloudTrail for API activity, and Amazon GuardDuty for threat detection. IAM policies can only control whether a principal is permitted to use such monitoring services, not perform the monitoring itself.
- ✓
Define fine-grained permissions with policies
Why this is correct
IAM policies are the core mechanism for defining fine-grained permissions. You can craft JSON-based identity policies that specify exactly which actions are allowed or denied on which resources, under what conditions (e.g., source IP, MFA presence, time of day). This allows least-privilege access control at the resource and API-action level, central to IAM's purpose.
- ✗
Manage EC2 instance lifecycle
Why it's wrong here
IAM does not manage EC2 instance lifecycle operations such as launching, stopping, or terminating instances. Those actions are performed by the Amazon EC2 service (or Auto Scaling) via EC2 APIs. IAM's role is to control whether a user, group, or role is authorized to call those EC2 APIs, but it never directly orchestrates the instance lifecycle.
- ✓
Create and manage IAM users and groups
Why this is correct
Creating and managing IAM users and groups is a foundational feature of IAM. Users represent individual principals with long-term credentials, and groups let you organize users and apply permissions collectively via attached policies. IAM also supports roles for temporary credentials, but user and group management remains one of its most basic and commonly used capabilities.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.