On an Amazon EC2 instance, an application is running that makes use of Amazon Simple Queue Service (Amazon SQS) queues. A SysOps administrator must guarantee that an application is capable of…

Question

Options

• ACreate an IAM user with an IAM policy that allows the sqs:SendMessage permission, the
• BCreate an IAM user with an IAM policy that allows the sqs:SendMessage permission, the
• CCreate and associate an IAM role that allows EC2 instances to call AWS services.
• DCreate and associate an IAM role that allows EC2 instances to call AWS services.

• A
  7% (2)
• C
  3% (1)
• D
  90% (27)

Explanation

Option D is correct because it uses an IAM role attached directly to the EC2 instance with only the specific SQS permissions required (read, write, delete) - satisfying both the principle of least privilege and avoiding the security risk of storing long-term credentials on the instance. IAM roles automatically rotate temporary credentials via the EC2 metadata service, eliminating the risk of compromised static access keys.

Options A and B are wrong because they use IAM users, which require generating and storing access keys on the EC2 instance - a significant security risk since those keys can be exfiltrated if the instance is compromised. Option C is likely wrong because it grants overly broad permissions (e.g., full SQS access or all AWS service access) rather than scoping down to only the three actions the application actually needs.

Memory tip: On AWS exams, whenever an EC2 instance needs to call an AWS service, the answer is almost always an IAM role (not an IAM user) with the minimum permissions required - roles = no stored credentials + temporary tokens, which is the AWS gold standard for instance-to-service auth.

No community discussion yet for this question.