SCS-C03 Identity and Access Management Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Store AWS access keys in a configuration file within the application's source code.

  Why it's wrong here

  Storing credentials in source code is a major security risk, as they can be easily exposed through version control systems or unauthorized access to the server. If these keys are compromised, they provide permanent access until manually revoked, making them difficult to manage and rotate securely.

• ✓

  Assign an IAM role to the EC2 instance using an instance profile.

  Why this is correct

  Using an IAM role allows the application to retrieve temporary security credentials from the Instance Metadata Service (IMDS). This is the most secure method because the credentials are automatically rotated by AWS and are never stored permanently on the instance or in the application code.

• ✗

  Use the root user's access keys to ensure the application has uninterrupted access to all resources.

  Why it's wrong here

  Using root credentials for any application task is a violation of the principle of least privilege and a critical security failure. Root credentials provide unrestricted access to the entire AWS account and should only be used for the few tasks that specifically require them, never for routine operations.

• ✗

  Create an IAM user with S3 permissions and hardcode its credentials in the EC2 User Data script.

  Why it's wrong here

  User Data scripts are stored in plain text and can be viewed by anyone with access to the EC2 console or the instance metadata. Hardcoding user credentials here is essentially the same as storing them in source code, exposing the account to unnecessary risk and management complexity.