DVA-C02 Security Practice Question
A company has a legacy application running on an EC2 instance that stores database credentials in a plain text configuration file. The security team requires that credentials be stored securely and rotated every 90 days. The developer must minimize changes to the application code. The application currently reads the configuration file from the file system. Which solution meets these requirements?
⚠ Common exam trap
Many exam-takers confuse AWS Secrets Manager with Systems Manager Parameter Store, assuming both support automatic rotation, but Parameter Store does not provide built-in rotation capabilities, making Secrets Manager the only correct choice for automated rotation requirements.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Secrets Manager to store the credentials and configure automatic rotation with a Lambda function. Modify the application to retrieve the secret from Secrets Manager.
AWS Secrets Manager provides built-in support for automatic credential rotation using a Lambda function, meeting the 90-day rotation requirement without manual intervention. By modifying the application to retrieve the secret via the Secrets Manager API, the credentials are no longer stored in plain text, satisfying the security team's mandate. This approach minimizes code changes because the application only needs to replace the file read with an API call, preserving the existing logic structure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt the configuration file using AWS KMS and store the encrypted file on S3.
Why it's wrong here
While storing an encrypted configuration file on S3 using KMS provides data at rest encryption, it does not address the crucial requirement for automatic credential rotation. Manually rotating credentials within such a file would involve a complex, multi-step process of decrypting, updating, re-encrypting, and redeploying the file, which is both error-prone and operationally intensive. This approach lacks the dynamic secret management capabilities essential for maintaining a strong security posture in modern applications.
- ✓
Use AWS Secrets Manager to store the credentials and configure automatic rotation with a Lambda function. Modify the application to retrieve the secret from Secrets Manager.
Why this is correct
AWS Secrets Manager is the most appropriate solution for managing application credentials, offering robust features like automatic rotation. By integrating with a custom Lambda function, Secrets Manager can programmatically rotate credentials for databases, API keys, or other services on a defined schedule, significantly enhancing the security posture. The application only needs to be modified to retrieve the current secret value from Secrets Manager at runtime, abstracting the actual credential management and minimizing code changes.
- ✗
Store the credentials in environment variables on the EC2 instance.
Why it's wrong here
Storing credentials directly in environment variables on an EC2 instance is highly insecure and provides no mechanism for automatic rotation. These variables can be easily accessed by other processes or users with sufficient permissions on the instance, creating a significant attack surface and increasing the risk of compromise. Furthermore, managing credential rotation would require manual intervention, such as SSHing into the instance and updating variables, which is impractical, not scalable, and prone to errors.
- ✗
Store the credentials in AWS Systems Manager Parameter Store as a SecureString and retrieve them at application startup.
Why it's wrong here
While AWS Systems Manager Parameter Store with SecureString provides encryption for sensitive data at rest and in transit, offering a more secure option than environment variables, it natively lacks the capability for automatic credential rotation. Although it secures the storage of secrets, manual intervention would still be required to update the SecureString parameter whenever credentials need to be rotated. This makes it less suitable for scenarios demanding automated lifecycle management of secrets to comply with security best practices.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.