SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store IAM access keys in a configuration file on the EC2 instance.

  Why it's wrong here

  Storing static keys on an EC2 instance is a significant security risk. If the instance is compromised, the attacker can extract the keys and gain permanent access to the AWS account. Furthermore, managing the lifecycle and rotation of these keys creates unnecessary manual work and potential for security drift.

• ✓

  Attach an IAM role to the EC2 instance profile.

  Why this is correct

  IAM roles provide temporary security credentials that are automatically rotated by AWS. By attaching a role to the EC2 instance, the application gains the necessary permissions without the need for static credentials, which is the industry standard for secure service-to-service authentication and authorization within the AWS ecosystem.

• ✗

  Assign the EC2 instance a public IP address.

  Why it's wrong here

  A public IP address is a networking configuration, not an authentication or authorization mechanism. It provides no security benefit for accessing DynamoDB and actually exposes the instance to potential inbound internet traffic. Security should be managed through IAM policies, not by modifying network accessibility or IP address allocation.

• ✗

  Use the root user credentials for the application.

  Why it's wrong here

  Using root credentials is a severe violation of security best practices. The root user has full, unrestricted access to the entire AWS account. If an application is compromised, the entire account, including all resources and billing information, is at risk. Never use root credentials for any programmatic application access.