SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store IAM user credentials in a configuration file on the EC2 instance.

  Why it's wrong here

  Storing long-term credentials in configuration files is a significant security risk, as anyone with access to the file system can compromise the account. If the instance is breached or the code is shared, the credentials could be used maliciously to access sensitive data across the AWS environment.

• ✓

  Create an IAM role with the required permissions and attach it to the EC2 instance profile.

  Why this is correct

  Attaching an IAM role to an EC2 instance allows the application to use temporary security credentials provided by the Instance Metadata Service. This eliminates the need to hardcode or store long-term keys, adhering to the principle of least privilege and significantly improving the overall security posture.

• ✗

  Pass the Access Key and Secret Key as environment variables when starting the application.

  Why it's wrong here

  Using environment variables to store credentials is slightly better than configuration files but still leaves the keys vulnerable to exposure through process monitoring tools or logs. This method still relies on long-term credentials that must be manually rotated, which increases the operational burden and risk.

• ✗

  Embed the credentials directly into the application source code.

  Why it's wrong here

  Hardcoding credentials into source code is one of the most dangerous security practices. If the code is pushed to a version control system like GitHub, the credentials can be easily discovered by unauthorized parties, leading to full account compromise and potential data theft from the DynamoDB table.