Exams / CLF-C02 / IAM users, groups and policies / Question 1
CLF-C02 practice question: IAM users, groups and policies (1 of 2)
Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
An application running on Amazon EC2 instances needs to write files to an Amazon S3 bucket. The security team does not want any long-term access keys stored on the instances. What should the company use?
Choose one answer.
- AA. An IAM user's access key saved in the application's configuration file
- BB. The root user's credentials stored as an environment variable
- CC. An IAM role attached to the instances through an instance profile
- DD. A security group rule that allows outbound traffic to Amazon S3
Show the answer and explanation
Answer: C
- A. Wrong: This stores a long-term credential on the instance, which is exactly what the security team wants to avoid.
- B. Wrong: Root credentials have unrestricted access and should never be used by applications.
- C. Right: Correct. The role supplies temporary credentials that are rotated automatically, so no long-term keys are stored on the instance.
- D. Wrong: Security groups control network traffic. They do not grant permission to call AWS APIs such as writing to S3.
Explanation
IAM roles are the recommended way to give AWS permissions to applications on EC2. The role is attached through an instance profile and provides temporary credentials that are rotated automatically, so there are no keys to store, share or rotate by hand. The role's policy should allow only the actions the application needs.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.