ExamPark
Course menuCLF-C02

Exams / CLF-C02 / IAM users, groups and policies / Question 1

CLF-C02 practice question: IAM users, groups and policies (1 of 2)

Security and Compliance A free question from our original CLF-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

An application on Amazon EC2 instances must write files to one Amazon S3 bucket.

The security team forbids long-term access keys on the instances, and it requires the application to have only the permissions it needs.

What should the company use?

Choose one answer.

  1. A. An IAM user's access key, stored in an encrypted file on each instance
  2. B. A role attached through an instance profile, with the AdministratorAccess policy
  3. C. A role attached through an instance profile, allowing writes to one bucket only
  4. D. The root user's access keys, saved as an environment variable on each instance
Show the answer and explanation

Answer: C

  • A. Wrong: This is a long-term credential stored on the instances, which the security team forbids. Encrypting the file does not change that.
  • B. Wrong: The role supplies temporary credentials, so no long-term keys are stored. But AdministratorAccess grants far more than writing to one bucket, which breaks the least-privilege requirement.
  • C. Right: Correct. The role supplies temporary credentials that AWS rotates automatically, so nothing long-term is stored on the instances. Its policy limits the application to writing to this one bucket. Learn more: Security best practices in IAM (opens in a new tab)
  • D. Wrong: Root user credentials have unrestricted access and should never be used by applications. Storing them on instances also creates long-term keys, which the policy forbids.

Explanation

IAM roles are the recommended way to give applications on EC2 access to AWS. The instance profile supplies temporary credentials that AWS rotates automatically, so no long-term keys sit on the instance. Least privilege means the role's policy should allow only the actions the application needs, such as writing to one bucket.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free CLF-C02 practice examPractice IAM users, groups and policiesAll IAM users, groups and policies questions

Want more on IAM users, groups and policies? The 5 full-length practice sets have 10 more IAM users, groups and policies questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets