DVA-C02 Deployment Practice Question
A company is deploying a web application on AWS Elastic Beanstalk. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not exposed in the application code or environment variables. Which TWO methods are secure ways to manage credentials? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store credentials in AWS Secrets Manager and retrieve them at runtime.
Options A and D are correct. AWS Secrets Manager and AWS Systems Manager Parameter Store (with SecureString parameter type) are secure services for storing and retrieving database credentials at runtime. Option B is incorrect because storing credentials in an S3 bucket is not a secure practice for secrets management, even with server-side encryption, as access policies may inadvertently expose the bucket and it is not designed for secret rotation or fine-grained access control. Option C is incorrect because hardcoding credentials in the application code exposes them in version control and to anyone with access to the code. Option E is incorrect because environment variables in Elastic Beanstalk can be viewed in the environment configuration and may be exposed in logs or through other AWS services if not carefully managed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store credentials in AWS Secrets Manager and retrieve them at runtime.
Why this is correct
AWS Secrets Manager encrypts secrets with KMS keys and provides a dedicated GetSecretValue API for runtime retrieval, so application code never contains or resolves the secret itself. It also supports automatic rotation of database credentials via Lambda, fine-grained IAM policies, and cross-account access, making it the most built-for-purpose option for dynamically fetching secrets in an Elastic Beanstalk environment.
- ✗
Store credentials in an Amazon S3 bucket with server-side encryption.
Why it's wrong here
S3 server-side encryption (SSE-S3 or SSE-KMS) protects data at rest, but using S3 as a secret store forces the application to manually perform a GET object request and parse the returned content, with no built-in secret rotation or dedicated secret access API. Access control requires intricate bucket policies and principal conditions, and deleted or overwritten secrets may remain recoverable in previous object versions unless lifecycle rules are configured. S3 is an object storage service, not a secrets manager, so it lacks the operational controls and runtime integration needed for production credentials.
- ✗
Hardcode credentials in the application configuration file.
Why it's wrong here
Hardcoding credentials in an application configuration file exposes them to anyone with access to the repository, artifact, or instance, and they are often accidentally committed to source control and retained in history indefinitely. Configuration files are frequently copied into logs, machine images, or debugging output, and rotating a hardcoded secret requires a new deployment and often a full code change. This practice directly violates AWS security best practices, which mandate that secrets be stored in a managed service and resolved at runtime.
- ✓
Store credentials in AWS Systems Manager Parameter Store with SecureString parameter type.
Why this is correct
SSM Parameter Store SecureString parameters are encrypted with AWS KMS and can be retrieved at runtime using the GetParameter API, enabling Elastic Beanstalk applications to obtain secrets without placing them in code or environment variables. It offers a hierarchical structure, support for IAM fine-grained access, and a lower cost compared to Secrets Manager, which makes it a valid alternative for many scenarios. However, it does not natively provide automatic secret rotation; if rotation is required, you would need to pair it with Secrets Manager or build custom logic, but as a standalone secure secret store it is acceptable.
- ✗
Store credentials as environment variables in the Elastic Beanstalk environment.
Why it's wrong here
Elastic Beanstalk environment variables are set as plain text in the environment configuration and are visible to any user with EB management permissions; they are also passed directly to the application process and can be exposed via stack traces, logs, or /proc/self/environ on the underlying EC2 instance. They do not support per-secret IAM access, are not encrypted by default, and rotation requires a full environment redeployment or configuration update. Therefore, they should be used only for non-sensitive configuration settings, not for database passwords or API keys.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.