Examkin

Question

Difficulty: HardIdentity and Access Management (IAM)

An organization is deploying a new containerized application on Amazon EC2 instances that must periodically write application state data to an Amazon DynamoDB table. Additionally, an external compliance auditor requires temporary read-only access to the DynamoDB table to verify data integrity. Which two configurations represent the most secure AWS-recommended practices for managing these access requirements? (Select two.)

  1. Attach an IAM role with DynamoDB write permissions to the EC2 instance profile.Answer
  2. Create an IAM role with a trust policy that allows the external auditor to assume it for read-only access.Answer
  3. C
    Generate long-term IAM access keys for a dedicated IAM user and embed them in the application configuration on the EC2 instances.
  4. D
    Share the AWS account root user credentials with the auditor while ensuring multi-factor authentication (MFA) is active on the account.
  5. E
    Submit an AWS support ticket requesting a service-level exception to disable IAM authorization for the EC2 instance's public IP address.

Answer

The correct configurations are attaching an IAM role with DynamoDB write permissions to the EC2 instance profile, and creating an IAM role with a trust policy that allows the external auditor to assume it for read-only access.
Attaching an IAM role to the EC2 instance profile ensures the application automatically receives temporary security credentials to write to DynamoDB without hardcoding keys. Creating an IAM role with a trust policy allows the external auditor to assume the role and obtain temporary, read-only permissions without requiring permanent credentials.

Step-by-Step Solution

1
Determine the secure method for applications running on EC2 instances to access other AWS services.
Identify that IAM roles attached to an instance profile allow services to retrieve temporary credentials, which is more secure than hardcoding credentials.
This avoids exposing permanent access keys in the code or server configurations.
2
Determine the secure method for external third parties to access the AWS environment temporarily.
Identify that creating a role with a trust policy allows federated or cross-account users to assume that role and receive temporary, read-only access.
This prevents creating permanent IAM users or sharing sensitive administrative credentials.
3
Verify if either of the correct options corresponds to AWS management or root user tasks.
Confirm that using the root user or asking AWS to disable IAM authorization violate basic security guidelines.
AWS credentials must follow the principle of least privilege, and access control is a customer responsibility under the Shared Responsibility Model.

Key Concept

Applying the principle of least privilege and using temporary security credentials via IAM roles instead of long-term access keys or sharing root account credentials.
Rate this question

Topics

Identity and Access Management (IAM)

More questions from this topic