CCOA Securing Assets Practice Question
You are managing access for a cloud-native application using AWS IAM. You need to ensure that an EC2 instance can only access a specific S3 bucket. What is the most secure way to implement this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.
IAM roles attached to EC2 instances are the standard and secure way to manage permissions without hardcoding keys or using overly broad policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an IAM Group and add the EC2 instance to the group.
Why it's wrong here
EC2 instances cannot be added to IAM groups; they use IAM roles.
- ✗
Create an IAM user with access keys and embed them in the application configuration file.
Why it's wrong here
Embedding keys is a security risk and violates best practices for secret management.
- ✓
Attach an IAM Role with a policy restricted to the specific S3 bucket ARN to the EC2 instance profile.
Why this is correct
IAM roles provide temporary credentials and are the identity-based mechanism for granting scoped access to AWS services.
- ✗
Modify the S3 bucket policy to allow 'All Principals' and restrict by IP address.
Why it's wrong here
Relying on IP restrictions for bucket access is weak compared to IAM roles and can be easily bypassed if IPs are dynamic.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva writes every CCOA question from scratch — 203 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed August 2026 · checked against the official ISACA exam blueprint
This CCOA practice question is part of Courseiva's free ISACA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCOA exam.