An Amazon EC2 instance is running an application that uses Amazon Simple Queue Service (Amazon SQS) queues. A SysOps administrator must ensure that the application can read, write, and delete…

Question

Options

• ACreate an IAM user with an IAM policy that allows the sqs:SendMessage permission, the
• BCreate an IAM user with an IAM policy that allows the sqs:SendMessage permission, the
• CCreate and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM
• DCreate and associate an IAM role that allows EC2 instances to call AWS services. Attach an IAM

• A
  9% (2)
• B
  17% (4)
• C
  4% (1)
• D
  70% (16)

Explanation

Option D is correct because IAM roles attached to EC2 instances (via instance profiles) provide temporary, automatically rotated credentials - the instance assumes the role and receives short-lived credentials through the instance metadata service, eliminating the need to store long-term secrets anywhere on the instance.

Why A and B are wrong: Both create an IAM user, which generates long-term access keys. These keys must be stored on the EC2 instance (e.g., in environment variables or config files), creating a persistent security risk if the instance is compromised or the key is accidentally exposed. Long-term credentials are always less secure than temporary ones.

Why C is wrong: C likely attaches an overly permissive policy (e.g., sqs:* or AmazonSQSFullAccess) rather than scoping permissions to only what is needed (read, write, delete). D is correct because it uses the principle of least privilege - attaching a policy with only the specific SQS actions required (sqs:ReceiveMessage, sqs:SendMessage, sqs:DeleteMessage).

Memory tip: Think "Roles for resources, Users for humans." EC2 instances are AWS resources, so they should always authenticate via IAM roles - never via IAM users with stored keys. On the exam, whenever an AWS service needs to call another AWS service, an IAM role is the secure answer.

No community discussion yet for this question.