SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Configure a security group rule that allows outbound traffic to S3.

  Why it's wrong here

  A security group acts as a virtual stateful firewall at the instance network interface level, filtering traffic by IP, protocol, and port. While allowing outbound HTTPS to S3 IP ranges would permit a TCP connection, the S3 API requires authenticated requests signed with AWS credentials (SigV4) that the instance has no way to generate without an IAM role or user. Therefore, this rule addresses connectivity only, not the identity and authorization needed to list, read, or write objects.

• ✗

  Assign a bucket policy that grants access to the EC2 instance's public IP address.

  Why it's wrong here

  A bucket policy is a resource-based policy that can include a condition like aws:SourceIp to restrict access to a specific public IP, but the policy alone does not supply the EC2 instance with an identity to authenticate. The instance must still present valid AWS credentials as a principal (e.g., an IAM role) to sign the API request; a public IP address is merely a network attribute and not a substitute for authentication. Moreover, public IPs can change or be shared via NAT, making this an unreliable control.

• ✓

  Create an IAM role with S3 permissions and attach it to the EC2 instance profile.

  Why this is correct

  Attaching an IAM role to the EC2 instance via an instance profile is the AWS-recommended approach because it provides the instance with temporary, rotated credentials automatically. The instance retrieves these credentials from the instance metadata service (IMDSv2) after assuming the role, and the AWS SDK on the instance automatically uses them to sign S3 API requests without any hard-coded keys. This follows least privilege and eliminates the operational burden of key management on the instance.

• ✗

  Create an IAM user with programmatic access and store the credentials in a file on the instance.

  Why it's wrong here

  Creating an IAM user with programmatic access and storing its access key ID and secret access key on the instance exposes long-term credentials that do not rotate and can be exfiltrated if the instance is compromised or the file is read. This violates the best practice of using IAM roles for EC2, because the credentials remain valid even after the instance is terminated unless manually revoked by an administrator. It also requires secure key distribution and periodic rotation, adding complexity and risk.

Go deeper

Related to this question