CLF-C02 Cloud Technology and Services Practice Question
A company wants to store frequently changing configuration data and feature flags that their applications need to read at runtime without hard-coding values. Which AWS service provides secure, centralized configuration storage with version history?
⚠ Common exam trap
Watch out — candidates often confuse Amazon S3's object versioning with configuration version history, but S3 lacks the centralized parameter management, secure runtime access patterns, and integration with AWS KMS that Parameter Store provides for frequently changing configuration data.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager Parameter Store
AWS Systems Manager Parameter Store is the correct choice because it provides a secure, centralized service for storing configuration data and feature flags, with built-in version history for each parameter. It allows applications to read configuration values at runtime via the AWS SDK or CLI without hard-coding, and supports encryption using AWS KMS for sensitive data.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3
Why it's wrong here
Amazon S3 is a highly durable object storage service, not a low-latency parameter store; it stores files (objects) rather than individual configuration keys. While S3 can host configuration files, its versioning operates at the object level—requiring an application to know specific version IDs—and it lacks built-in per-parameter IAM authorization, KMS-based encryption visibility for SecureString, and the hierarchical naming convention Parameter Store offers (e.g., /dev/app/config/db-url). S3 is not natively integrated with AWS services to fetch individual parameters, so it would add significant application complexity.
- ✓
AWS Systems Manager Parameter Store
Why this is correct
AWS Systems Manager Parameter Store is a purpose-built, centralized store for configuration data and secrets, supporting String, StringList, and SecureString parameter types. It provides automatic versioning with rollback capability, integrates natively with AWS Identity and Access Management for fine-grained permissions, and uses AWS KMS to encrypt SecureString values with customer-managed keys. Standard parameters are free, while advanced parameters support hierarchical namespaces and parameter policies such as expiration, making this the ideal service for this use case.
- ✗
Amazon DynamoDB
Why it's wrong here
Amazon DynamoDB is a fully managed NoSQL key-value database designed for high-scale transactional and operational workloads, not for storing application configuration. Using DynamoDB would require you to design a table schema, implement application-side versioning and fetching logic, manage capacity and consumption costs, and build custom IAM and KMS integration for per-parameter access control and encryption. Systems Manager Parameter Store offers a simple parameter-oriented API with automatic versioning, native IAM permissions, and built-in KMS encryption for SecureString values, making it the purpose-built choice.
- ✗
AWS CloudFormation
Why it's wrong here
AWS CloudFormation is an infrastructure-as-code service that provisions and manages AWS resources based on declarative JSON or YAML templates. Although CloudFormation can reference Parameter Store parameters as dynamic values during stack creation (e.g., using the 'ssm' dynamic reference), it does not provide a runtime API for applications to read configuration data after deployment. It is a stateful deployment engine, not a queryable store, and confusing CloudFormation stack parameters with runtime application parameters is a common misconception.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.