SCS-C02 Management and Security Governance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Generate an access key and secret key for an IAM user and store them in the EC2 instance.

  Why it's wrong here

  IAM user access keys are long-term static credentials that must be securely stored and manually rotated on every instance; they often end up in source code, configuration files, or environment variables, creating a severe leak risk if the instance is compromised. Each instance would require its own copy of the key material, which is operationally inefficient and makes emergency credential rotation nearly impossible. An instance profile instead delivers automatically rotated temporary credentials without any persistent secret material on the instance.

• ✗

  Use an SCP to allow the EC2 instance to access the S3 bucket.

  Why it's wrong here

  An SCP is an AWS Organizations policy that sets permission boundaries for an entire account or organizational unit, not a mechanism for granting an individual EC2 instance access to a resource. SCPs can only restrict what identities can do once an IAM policy already grants them permissions; they cannot, by themselves, authorize an instance to reach an S3 bucket. To access S3, the instance must assume an IAM role that has an S3 permission policy, and any applicable SCP must not explicitly deny that access.

• ✗

  Store the credentials in the AMI used to launch the instance.

  Why it's wrong here

  Embedding credentials in an AMI means baking long-term or temporary secrets into a snapshot, which can be copied, shared, launched, and examined by any entity with access to that AMI, exposing the secrets to anyone who can create an EC2 instance from it. If the AMI is ever made public or shared with a compromised account, the embedded keys are irrecoverably leaked. Even within a private account, using baked-in credentials makes rotation impossible without rebuilding and redeploying every instance from a new AMI, and any instance launched from the AMI inherits the same static secret.

• ✓

  Create an IAM role with the required permissions and attach it to the EC2 instance as an instance profile.

  Why this is correct

  An instance profile is a container for an IAM role that you attach to an EC2 instance, and its trust policy allows the EC2 service to assume the role on behalf of the instance. When the instance calls the instance metadata service (IMDS) at 169.254.169.254, it receives temporary security credentials with the role's permissions, and these credentials are automatically rotated before they expire. This eliminates the need to store any long-term access key on the instance, keeps permissions centrally managed, and is the secure AWS-recommended approach for granting instance-level access to resources like S3.

Go deeper

Related to this question