DOP-C02 Security and Compliance Practice Question
A company is running a critical application on an Amazon EC2 instance that needs to access an S3 bucket. The application must use temporary credentials that automatically rotate. The DevOps engineer must ensure that the credentials are never stored on disk. Which approach meets these requirements?
⚠ Common exam trap
Watch out — candidates often confuse AWS Secrets Manager or Parameter Store with a solution for automatic credential rotation, not realizing that those services store static secrets unless explicitly configured with rotation via Lambda, whereas an IAM instance profile inherently provides automatically rotating temporary credentials without any disk storage.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM role to the EC2 instance and use the instance profile to obtain temporary credentials from the instance metadata service.
Attaching an IAM role to the EC2 instance and using the instance profile allows the application to obtain temporary credentials from the EC2 instance metadata service (IMDS). These credentials are automatically rotated by AWS before they expire, and they are never stored on disk—they are fetched on-demand from the metadata endpoint (http://169.254.169.254/latest/meta-data/iam/security-credentials/). This satisfies both the requirement for automatic rotation and the prohibition against disk storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the credentials in AWS Secrets Manager and retrieve them at application startup.
Why it's wrong here
Storing the application's AWS access keys in Secrets Manager still leaves a chicken-and-egg problem: the EC2 instance must present valid AWS credentials to call the Secrets Manager API before it can retrieve the stored keys. You could bootstrap with an instance profile, but then the instance profile's temporary credentials would be enough to run the entire workload, making the stored long-term keys unnecessary. It also adds a service dependency during startup and keeps static secrets in a retrievable form.
- ✓
Attach an IAM role to the EC2 instance and use the instance profile to obtain temporary credentials from the instance metadata service.
Why this is correct
The best practice is to attach an IAM role to the EC2 instance; the instance profile exposes temporary security credentials via the Instance Metadata Service (IMDSv2), which the AWS SDKs automatically load and refresh. These credentials are short-lived, rotated automatically, and never written to disk, so no secret material is present in the file system, environment variables, or configuration files. This eliminates the need to manage access keys manually and reduces the risk of exposure if the instance is compromised.
- ✗
Use AWS Systems Manager Parameter Store to store the credentials and retrieve them using the EC2 instance's IAM role.
Why it's wrong here
Using Systems Manager Parameter Store with the instance's IAM role is better than hardcoding keys, but it still does not solve the secret-rotation problem: the parameter itself contains long-lived credentials (for example, an IAM user's access key or a database password) that must be rotated manually or through an external process. The IAM role only authenticates the instance to fetch the parameter; it does not make the stored secret temporary. Parameter Store also lacks native automatic rotation, unlike Secrets Manager, and the retrieved secret remains in memory for the application's lifetime, so static credentials still exist in your environment.
- ✗
Generate an access key and secret key for an IAM user and store them in a configuration file on the EC2 instance.
Why it's wrong here
Creating a long-term access key/secret key for an IAM user and placing them in a config file on the instance is fundamentally insecure because the key material is at rest and can be exposed via accidental file reads, log outputs, disk snapshots, or a compromised process. IAM access keys do not expire unless you explicitly rotate them, so the blast radius is broad and the manual rotation burden is significant. The whole point of an instance profile is to avoid having any persistent, reusable credentials on an EC2 host.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer needs to allow an EC2 instance to read from an S3 bucket. Which is the most secure way to grant this access?
easy- A.Use the root user credentials of the AWS account.
- B.Store AWS access keys in the instance's user data and use them in the application.
- C.Create an S3 bucket policy that allows the EC2 instance's public IP address.
- ✓ D.Create an IAM role with an S3 read policy and attach it to the EC2 instance profile.
Why D: The most secure way to grant an EC2 instance access to an S3 bucket is to use an IAM role with an S3 read policy attached to the instance profile. This allows the instance to obtain temporary security credentials via the instance metadata service, avoiding hardcoded keys or exposing credentials. Option A is wrong because root credentials are overly privileged and should never be used for routine access. Option B is wrong because storing access keys in user data is insecure—keys can be exposed through instance metadata or logs. Option C is wrong because bucket policies based on public IP addresses are not secure; IPs can change and other instances could have the same IP, plus S3 bucket policies should not rely on IP addresses for authentication. Option D is the correct approach because it uses IAM roles, the best practice for granting permissions to AWS services.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.