I85PREP
⌘ K
AWS CRI study materials
AWS CRI study resources

AWS Certified Cloud Practitioner practice questions

One question at a time. Build your AWS CRI understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Cloud Concepts

A company wants to move from making large upfront capital purchases for data center hardware to a pay-as-you-go model where costs track actual consumption. Which cloud benefit does this describe?

  1. Increasing speed and agility
  2. Trading capital expense for variable expense Correct answer.
  3. Benefiting from massive economies of scale
  4. Going global in minutes

Explanation

Moving from upfront capital expenditure to variable operational expenditure is the classic definition of trading capex for opex. Customers pay only for resources consumed, which removes the need to over-provision hardware in advance.

Question 2Cloud Concepts

Which statement best describes the AWS shared responsibility model?

  1. AWS is responsible for security of the cloud, while the customer is responsible for security in the cloud Correct answer.
  2. Responsibility for patching is shared equally for every service regardless of type
  3. AWS is responsible for all security controls once a workload is deployed
  4. The customer is responsible for the physical security of AWS data centers

Explanation

The shared responsibility model divides duties: AWS secures the underlying infrastructure (security of the cloud), and customers secure what they put in and on it (security in the cloud). The split shifts depending on whether a service is IaaS, PaaS, or managed.

Question 3Cloud Concepts

Which AWS global infrastructure component is composed of one or more discrete data centers with redundant power, networking, and connectivity?

  1. AWS Region
  2. Edge location
  3. AWS Direct Connect location
  4. Availability Zone Correct answer.

Explanation

An Availability Zone is one or more discrete data centers in a Region, each with independent power, cooling, and networking. Regions are collections of AZs, and edge locations are separate points of presence for content delivery.

Question 4Cloud Concepts

A startup needs to run a batch job for a few hours and wants to avoid any long-term commitment while paying the lowest compute price available. Which purchasing option fits best?

  1. Spot Instances Correct answer.
  2. Reserved Instances
  3. Dedicated Hosts
  4. On-Demand Instances

Explanation

Spot Instances offer spare EC2 capacity at steep discounts with no long-term commitment, which suits interruption-tolerant batch work. The tradeoff is that capacity can be reclaimed with short notice, so the workload must handle interruption.

Question 5Cloud Concepts

Which cloud computing model delivers virtualized compute, storage, and networking that the customer configures and manages, including the operating system?

  1. Platform as a Service
  2. Function as a Service
  3. Infrastructure as a Service Correct answer.
  4. Software as a Service

Explanation

IaaS provides fundamental building blocks such as virtual machines, storage, and networking, while the customer manages the OS and applications. This contrasts with PaaS and SaaS, where more of the stack is managed by the provider.

Question 6Cloud Concepts

Which AWS service provides a managed relational database engine where AWS handles patching, backups, and hardware provisioning?

  1. Amazon RDS Correct answer.
  2. Amazon EC2
  3. Amazon S3
  4. AWS Lambda

Explanation

Amazon RDS is a managed relational database service that automates routine tasks such as patching, backups, and hardware provisioning. EC2 gives raw servers, S3 is object storage, and Lambda is serverless compute.

Question 7Cloud Concepts

A team wants to run code in response to events without provisioning or managing any servers. Which AWS service should they choose?

  1. Amazon EC2 Auto Scaling
  2. Amazon ECS on EC2
  3. AWS Elastic Beanstalk
  4. AWS Lambda Correct answer.

Explanation

AWS Lambda is a serverless compute service that runs code in response to events and manages all underlying infrastructure. The other options still involve servers or instances that the team provisions or scales.

Question 8Cloud Concepts

Which design principle of the AWS Well-Architected Framework recommends replacing large upfront infrastructure investments with the ability to scale capacity dynamically?

  1. Make architectural tradeoffs
  2. Stop guessing capacity Correct answer.
  3. Automate everything
  4. Use managed services

Explanation

The operational excellence design principle 'stop guessing capacity' encourages scaling capacity automatically instead of pre-provisioning for peak load. This avoids both idle over-provisioning and capacity shortfalls.

Question 9Cloud Concepts

What is the primary purpose of an AWS Region?

  1. To connect an on-premises network to AWS over a private link
  2. To host a single data center for a specific customer
  3. To cache content close to end users
  4. To provide a physically isolated geographic area containing multiple Availability Zones Correct answer.

Explanation

A Region is a geographic area with multiple isolated Availability Zones, letting customers place workloads near users and meet data residency needs. Edge locations, single data centers, and Direct Connect serve different purposes.

Question 10Cloud Concepts

A company runs a steady-state production workload that will remain constant for the next three years and wants to minimize compute cost. Which EC2 purchasing option is most appropriate?

  1. On-Demand Instances
  2. Spot Instances
  3. Reserved Instances or Savings Plans with a three-year term Correct answer.
  4. Dedicated Hosts

Explanation

For predictable, long-running workloads, Reserved Instances or Savings Plans with a multi-year commitment yield significant discounts over On-Demand. Spot is unsuitable for steady workloads that cannot tolerate interruption.

Question 11Cloud Concepts

Which statement accurately distinguishes Availability Zones from edge locations?

  1. Availability Zones host compute and storage within a Region, while edge locations are points of presence for delivering content closer to users Correct answer.
  2. Edge locations are grouped inside each Availability Zone to provide fault isolation
  3. Availability Zones are used only for content caching, while edge locations run databases
  4. Availability Zones and edge locations are interchangeable terms for the same facilities

Explanation

Availability Zones are isolated data center groups within a Region used for resilient compute and storage. Edge locations are separate points of presence, used by services such as CloudFront to cache content near end users.

Question 12Cloud Concepts

Under the shared responsibility model, which task remains a customer responsibility when using Amazon EC2?

  1. Patching the guest operating system on the instance Correct answer.
  2. Maintaining the physical security of the data center
  3. Securing the virtualization layer that runs the instances
  4. Replacing failed underlying host hardware

Explanation

With EC2, AWS manages the physical hosts, virtualization layer, and facilities, while the customer manages the guest OS, including patching and configuration. This is a key example of the customer's 'security in the cloud' duties.

Question 13Cloud Concepts

A company wants to reduce operational overhead by having AWS manage database patching and backups, but it needs to keep full control of the database engine version and configuration. Which approach best fits?

  1. Use Amazon S3 to store database files
  2. Run the database on Amazon RDS Correct answer.
  3. Run the database on Amazon EC2
  4. Run the database on AWS Lambda

Explanation

Amazon RDS automates patching and backups while still allowing the customer to choose and configure the engine version. Running on EC2 would shift patching and backup work back to the customer.

Question 14Cloud Concepts

Which characteristic of cloud computing lets a system automatically add capacity during a traffic spike and remove it afterward?

  1. Multi-factor authentication
  2. Durability
  3. Data residency
  4. Elasticity Correct answer.

Explanation

Elasticity is the ability to acquire resources as demand increases and release them when demand falls. Durability concerns data persistence, while the other options relate to security or compliance.

Question 15Cloud Concepts

A team is designing a workload that must survive the failure of an entire data center. Which approach provides the strongest resilience?

  1. Deploy the workload to a single edge location
  2. Rely on On-Demand pricing to recover from failures
  3. Deploy all instances in a single Availability Zone
  4. Deploy the workload across multiple Availability Zones in a Region Correct answer.

Explanation

Availability Zones are physically isolated, so spreading a workload across multiple AZs protects against the failure of any single data center. A single AZ or edge location remains a single point of failure.

Question 16Cloud Concepts

Which AWS service is best suited for storing and retrieving arbitrary files such as images and backups as objects?

  1. Amazon S3 Correct answer.
  2. Amazon EBS
  3. Amazon RDS
  4. AWS Lambda

Explanation

Amazon S3 is object storage designed for storing and retrieving any amount of data as objects, ideal for images, backups, and static assets. RDS is relational, EBS is block storage for instances, and Lambda is compute.

Question 17Cloud Concepts

A company wants to avoid over-provisioning servers for a web application whose traffic varies significantly by time of day. Which AWS capability directly addresses this?

  1. EC2 Auto Scaling groups Correct answer.
  2. Dedicated Hosts
  3. Reserved Instance purchases
  4. AWS Direct Connect

Explanation

Auto Scaling groups add or remove EC2 instances based on demand, matching capacity to traffic and avoiding over-provisioning. Reserved Instances and Dedicated Hosts are pricing or isolation choices, not dynamic scaling mechanisms.

Question 18Cloud Concepts

Which benefit of cloud adoption is most directly supported by the ability to provision new environments in minutes rather than weeks?

  1. Increased speed and agility Correct answer.
  2. Guaranteed lower cost for every workload
  3. Improved physical security of data centers
  4. Reduced need for identity management

Explanation

Rapid provisioning shortens experimentation and deployment cycles, which is the speed and agility benefit. It does not by itself guarantee lower cost or change security and identity requirements.

Question 19Cloud Concepts

A regulated company must keep customer data physically stored within a specific country. Which AWS global infrastructure decision addresses this requirement?

  1. Choosing an edge location nearest to customers
  2. Selecting an AWS Region located in that country Correct answer.
  3. Using a single Availability Zone in any Region
  4. Purchasing Reserved Instances

Explanation

Data residency requirements are met by choosing a Region in the required geography, since data stored in that Region remains there unless explicitly replicated. Edge locations and pricing options do not control where primary data resides.

Question 20Cloud Concepts

Which statement about the AWS shared responsibility model for a managed service such as Amazon S3 is accurate?

  1. The customer is responsible for the durability of the underlying storage media
  2. AWS is responsible for deciding who can read the customer's objects
  3. AWS operates the storage infrastructure, while the customer manages bucket policies, access controls, and data classification Correct answer.
  4. The customer is responsible for patching the storage hardware

Explanation

For S3, AWS runs the storage infrastructure and its durability, while the customer controls access through bucket policies, IAM, and data classification. Access decisions and data protection settings remain customer responsibilities.

Question 21Cloud Concepts

A company runs a containerized application and wants AWS to manage the underlying servers so the team focuses only on containers. Which service best matches this goal?

  1. Amazon EC2 with self-managed Docker
  2. AWS Lambda
  3. AWS Fargate Correct answer.
  4. Amazon RDS

Explanation

AWS Fargate is a serverless compute engine for containers that removes the need to provision or manage servers. Managing Docker on EC2 keeps server administration with the team, and the other options are not container runtimes.

Question 22Cloud Concepts

A workload must remain available even if an entire AWS Region becomes unavailable. Which design decision is required to meet this goal?

  1. Deploy across multiple Availability Zones in one Region
  2. Purchase three-year Reserved Instances
  3. Use a single edge location for all traffic
  4. Replicate the workload and data across multiple Regions Correct answer.

Explanation

Surviving a full Region outage requires a multi-Region architecture with replicated data and failover, since Availability Zones are contained within a single Region. Multi-AZ designs protect against data center failures but not Region-wide events.

Question 23Cloud Concepts

A company needs to run a licensed commercial database that requires dedicated physical servers for compliance reasons, and it must control host-level placement. Which EC2 option satisfies this?

  1. Savings Plans
  2. Spot Instances
  3. Dedicated Hosts Correct answer.
  4. On-Demand Instances on shared tenancy

Explanation

Dedicated Hosts provide physical servers fully dedicated to a single customer, which supports bring-your-own-license requirements and host-level control. Shared-tenancy and Spot options do not provide dedicated physical hardware.

Question 24Cloud Concepts

An architect must choose between a managed service and a self-managed deployment on EC2. Which consideration most strongly favors the managed service under the shared responsibility model?

  1. The customer becomes responsible for physical data center security
  2. The customer must still patch the underlying hypervisor
  3. The provider assumes responsibility for patching and operating the service layer, reducing the customer's operational burden Correct answer.
  4. The customer retains full control of the host operating system

Explanation

With managed services, AWS takes on patching and operation of the service layer, which lowers the customer's operational and security burden. Self-managed EC2 shifts more of those duties to the customer.

Question 25Cloud Concepts

A team wants to minimize cost for a fault-tolerant image-processing pipeline that can pause and resume. Which combination of design choices best achieves this?

  1. Use On-Demand Instances sized for peak load around the clock
  2. Use Dedicated Hosts for all processing nodes
  3. Use Spot Instances with checkpointing so interrupted work can resume Correct answer.
  4. Use three-year Reserved Instances sized for peak load

Explanation

Spot Instances offer the deepest discounts, and checkpointing lets the pipeline recover when capacity is reclaimed, matching the fault-tolerant requirement. Committed or dedicated options cost more and do not exploit the workload's flexibility.

Question 26Cloud Concepts

A startup wants to pay only for the compute capacity it actually consumes each hour and avoid buying hardware up front. Which cloud computing benefit does this describe?

  1. Reserved capacity purchased through a multi-year contract
  2. Fixed monthly subscription covering unlimited usage
  3. Pay-as-you-go pricing that converts capital expense into variable operating expense Correct answer.
  4. Dedicated host allocation billed per physical socket

Explanation

Cloud providers bill for consumed resources on demand, so a startup avoids large capital purchases and pays only for what it uses. This converts upfront capital expenditure into variable operating expenditure that scales with actual consumption. The other choices describe commitment or fixed-fee models that remove the variable-cost benefit.

Question 27Cloud Concepts

Which AWS global infrastructure construct is composed of one or more discrete data centers with independent power, cooling, and networking?

  1. A local zone
  2. An edge location
  3. An Availability Zone Correct answer.
  4. A Region

Explanation

An Availability Zone is one or more discrete data centers in a Region, each with independent power, cooling, and networking so failures do not cascade. Regions are collections of multiple Availability Zones, and edge locations are separate points of presence used for content delivery.

Question 28Cloud Concepts

Under the AWS shared responsibility model, which activity is always the customer's responsibility regardless of the service used?

  1. Patching the hypervisor that runs virtual machines
  2. Securing the physical facilities that host the hardware
  3. Maintaining the networking equipment inside the data center
  4. Managing the configuration of identity and access permissions Correct answer.

Explanation

Customers always control their own data, identities, and access configuration, which is often called security in the cloud. AWS is responsible for security of the cloud, including physical facilities, hypervisors, and network hardware.

Question 29Cloud Concepts

A company wants to run a workload without managing any servers and pay only when its code executes. Which AWS service matches this requirement?

  1. Amazon EC2
  2. Amazon RDS
  3. AWS Lambda Correct answer.
  4. Amazon EBS

Explanation

AWS Lambda runs code in response to events and bills per request and execution duration, with no server provisioning. EC2 requires managing instances, RDS is a managed database, and EBS is block storage.

Question 30Cloud Concepts

Which AWS service stores data as objects inside buckets and is commonly used for static website assets and backups?

  1. Amazon Elastic File System
  2. Amazon Elastic Block Store
  3. Amazon Simple Storage Service Correct answer.
  4. Amazon Glacier Vault

Explanation

Amazon S3 is object storage organized into buckets, suited to arbitrary files such as images, backups, and static assets. EBS provides block volumes for instances, and EFS provides a shared file system.

Question 31Cloud Concepts

Which AWS tool gives a consolidated view of cost and usage across multiple accounts and can forecast future spend?

  1. AWS Config
  2. AWS CloudTrail
  3. AWS Trusted Advisor
  4. AWS Cost Explorer Correct answer.

Explanation

Cost Explorer visualizes historical cost and usage and can forecast future spending, including across accounts linked through consolidated billing. CloudTrail records API activity, Config tracks resource configuration, and Trusted Advisor offers best-practice checks.

Question 32Cloud Concepts

A team wants to deploy infrastructure as code so environments are reproducible and version controlled. Which AWS service is designed for this?

  1. AWS Elastic Beanstalk
  2. Amazon CloudWatch
  3. AWS OpsWorks Stacks
  4. AWS CloudFormation Correct answer.

Explanation

CloudFormation lets teams define infrastructure in templates that can be versioned and redeployed consistently. Elastic Beanstalk deploys applications, CloudWatch monitors resources, and OpsWorks is a configuration management service.

Question 33Cloud Concepts

A company must keep data resident in a specific country and wants AWS to manage the underlying infrastructure. Which AWS global infrastructure element determines where the data is stored?

  1. The Availability Zone selected during deployment
  2. The local zone attached to the Region
  3. The edge location closest to the users
  4. The AWS Region selected for the resources Correct answer.

Explanation

The Region is the geographic boundary that determines where data is physically stored, which is how residency requirements are met. Availability Zones and local zones are subdivisions within a Region, and edge locations only cache content.

Question 34Cloud Concepts

A workload runs on a single Availability Zone and must tolerate the loss of that zone without downtime. What change is required?

  1. Migrate the workload to a single larger Region
  2. Deploy the workload across multiple Availability Zones within the Region Correct answer.
  3. Increase the instance size within the same Availability Zone
  4. Move the workload to an edge location closer to users

Explanation

Spreading resources across multiple Availability Zones removes the single point of failure and lets traffic shift when one zone fails. Enlarging instances or relocating to another Region does not protect against a zone-level outage.

Question 35Cloud Concepts

A team needs a managed message queue to decouple a web tier from a background processing tier. Which AWS service should they choose?

  1. AWS Step Functions
  2. Amazon Simple Notification Service
  3. Amazon Kinesis Data Streams
  4. Amazon Simple Queue Service Correct answer.

Explanation

Amazon SQS provides durable queues that decouple producers from consumers so each tier scales independently. SNS is publish-subscribe fan-out, Kinesis handles streaming analytics, and Step Functions coordinates workflows.

Question 36Cloud Concepts

An architect wants to choose a database that automatically scales throughput and latency for a key-value workload with unpredictable access patterns. Which AWS service fits best?

  1. Amazon Aurora on a fixed instance class
  2. Amazon Redshift
  3. Amazon RDS for MySQL with a reserved instance
  4. Amazon DynamoDB on-demand capacity mode Correct answer.

Explanation

DynamoDB on-demand mode automatically scales to the request volume without capacity planning, which suits unpredictable key-value traffic. Redshift is a data warehouse, and fixed-instance databases require capacity decisions.

Question 37Cloud Concepts

A company wants to run a stateless web application and let AWS handle capacity scaling and load balancing while the team only supplies application code. Which service is most appropriate?

  1. AWS Elastic Beanstalk Correct answer.
  2. Amazon ECS on Fargate
  3. Amazon EC2 Auto Scaling groups
  4. Amazon Lightsail

Explanation

Elastic Beanstalk deploys application code and provisions the underlying capacity, load balancing, and scaling automatically. Auto Scaling groups require more manual configuration, and Lightsail is a simplified fixed-price offering.

Question 38Cloud Concepts

Which design principle of the AWS Well-Architected Framework recommends testing recovery procedures and simulating failures?

  1. Test recovery procedures Correct answer.
  2. Automate everything
  3. Stop guessing capacity
  4. Make architectural tradeoffs

Explanation

The reliability pillar explicitly recommends testing how the workload fails and validating recovery procedures so unexpected failures can be handled. Automation and capacity planning are separate principles that do not cover failure testing.

Question 39Cloud Concepts

A company needs to run a batch job that can be interrupted and restarted, and wants the lowest compute cost. Which purchasing option should it use?

  1. On-Demand Instances
  2. Dedicated Hosts
  3. Spot Instances Correct answer.
  4. Reserved Instances

Explanation

Spot Instances offer steep discounts for fault-tolerant workloads because capacity can be reclaimed with short notice. A job that can pause and resume tolerates interruption, making Spot the cheapest fit.

Question 40Cloud Concepts

A team wants to monitor application metrics, set alarms, and view logs in a single AWS-native service. Which service should it use?

  1. AWS X-Ray
  2. Amazon CloudWatch Correct answer.
  3. AWS Health Dashboard
  4. AWS CloudTrail

Explanation

CloudWatch collects metrics and logs and supports alarms and dashboards for operational monitoring. CloudTrail records API activity, X-Ray traces requests, and the Health Dashboard reports service events.

Question 41Cloud Concepts

A company wants to give its developers programmatic access to AWS with temporary credentials rather than long-term access keys. Which service should it use?

  1. AWS Certificate Manager
  2. AWS Identity and Access Management users with access keys
  3. AWS Security Token Service Correct answer.
  4. AWS Key Management Service

Explanation

STS issues temporary, time-limited credentials that reduce the risk of long-lived access keys. IAM users with permanent keys, KMS encryption keys, and ACM certificates serve different purposes.

Question 42Cloud Concepts

A company wants to migrate a monolithic application to AWS with minimal changes and then gradually refactor it into services. Which migration strategy does this describe?

  1. Rehost Correct answer.
  2. Repurchase
  3. Retire
  4. Refactor

Explanation

Rehosting, often called lift and shift, moves the application to AWS with minimal changes and allows later incremental refactoring. Repurchasing replaces the application with a SaaS product, and refactoring rewrites it before migration.

Question 43Cloud Concepts

A workload must remain available even if an entire AWS Region becomes unavailable. Which design decision is required?

  1. Relying on edge locations to serve dynamic application traffic
  2. Deploying across multiple Availability Zones in one Region
  3. Deploying identical stacks in at least two Regions with data replication and traffic routing Correct answer.
  4. Using a single Region with larger instance types

Explanation

Region-level resilience requires independent deployments in multiple Regions plus replicated data and routing such as Route 53 failover. Multi-AZ protects against zone failure but not the loss of an entire Region.

Question 44Cloud Concepts

A company wants to reduce cost for a steady-state production workload that will run continuously for three years and can commit to that term. Which pricing approach is most economical?

  1. Dedicated Hosts
  2. Savings Plans or Reserved Instances Correct answer.
  3. Spot Instances
  4. On-Demand Instances

Explanation

Committing to a one- or three-year term through Savings Plans or Reserved Instances yields substantial discounts for predictable, steady usage. Spot is unsuitable for workloads that cannot tolerate interruption, and On-Demand is the most expensive for steady use.

Question 45Cloud Concepts

An architect is comparing a fully managed service with a self-managed deployment on Amazon EC2. Which factor most strongly favors the managed service?

  1. The team must run software that is only supported on a specific operating system build
  2. The team wants AWS to handle patching, scaling, and backups so operational overhead is reduced Correct answer.
  3. The workload requires installing custom kernel modules
  4. The team needs full control over the operating system kernel and hypervisor settings

Explanation

Managed services shift undifferentiated operational work such as patching, scaling, and backups to AWS, freeing the team to focus on application value. Requirements for kernel-level control or custom operating system builds favor self-managed EC2 instead.

Question 46Cloud Concepts

A company runs a licensed commercial database that requires dedicated physical servers for compliance and wants to control instance placement. Which Amazon EC2 option satisfies this?

  1. Shared tenancy instances
  2. Reserved Instances
  3. Dedicated Hosts Correct answer.
  4. Spot Instances

Explanation

Dedicated Hosts provide physical servers dedicated to a single customer, which supports licensing requirements and compliance controls. Spot, shared tenancy, and Reserved Instances do not guarantee physical isolation.

Question 47Cloud Concepts

A team wants to minimize cost for a fault-tolerant image-processing pipeline that can pause and resume and stores intermediate results durably. Which combination is most cost-effective?

  1. Dedicated Hosts with Amazon EFS
  2. On-Demand EC2 instances with instance store only
  3. Reserved Instances with Amazon EBS only
  4. Spot Instances with Amazon S3 for intermediate results Correct answer.

Explanation

Spot Instances provide low-cost interruptible compute, and storing intermediate results in S3 makes the pipeline durable and resumable if capacity is reclaimed. Reserved and Dedicated options cost more and add no benefit for interruptible work.

Question 48Cloud Concepts

A company must keep customer data physically stored within a specific country and wants AWS to manage the underlying infrastructure. Which AWS global infrastructure element determines where the data is stored?

  1. The edge location closest to the users
  2. The AWS Region selected for the resources Correct answer.
  3. The Availability Zone selected during deployment
  4. The local zone attached to the Region

Explanation

The Region is the geographic boundary that determines where data is physically stored, which is how residency requirements are met. Availability Zones and local zones are subdivisions within a Region, and edge locations only cache content.

Question 49Security and Compliance

In AWS, which service is primarily used to centrally manage permissions and enforce fine-grained access control policies across AWS accounts and resources?

  1. AWS Identity and Access Management (IAM) Correct answer.
  2. Amazon Inspector
  3. Amazon GuardDuty
  4. AWS Shield Advanced

Explanation

IAM is the core service for defining users, roles, and policies that grant or deny access to AWS resources. GuardDuty, Shield Advanced, and Inspector are detection and protection services, not permission management systems.

Question 50Security and Compliance

A company needs to grant an EC2 instance temporary credentials to call an S3 bucket without embedding long-term access keys. What is the recommended AWS approach?

  1. Hard-code credentials in the application configuration file
  2. Store IAM user access keys in the instance's user data
  3. Create an IAM group and add the instance to it
  4. Attach an IAM role to the instance via an instance profile Correct answer.

Explanation

Attaching an IAM role through an instance profile lets the EC2 instance obtain temporary, automatically rotated credentials from the instance metadata service. This avoids long-term keys and follows the principle of least privilege.