DVA-C02 Deployment Practice Question
A company is deploying a web application on AWS Elastic Beanstalk. The application uses an Amazon RDS database. The company wants to ensure that database credentials are not exposed in the application code or environment variables. Which TWO methods are secure ways to manage credentials? (Choose TWO.)
⚠ Common exam trap
DVA-C02 often tests whether candidates recognize that environment variables and S3-stored secrets are not secure credential stores, luring them toward 'encrypted S3' as if encryption alone made it a secrets manager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store credentials in AWS Secrets Manager and retrieve them at runtime.
Option A is correct because AWS Secrets Manager is purpose-built for storing and rotating secrets such as RDS database credentials, and the application can retrieve them at runtime via the AWS SDK using IAM permissions, so the credentials never appear in code or environment variables. Option D is correct because AWS Systems Manager Parameter Store supports the SecureString parameter type, which encrypts values with AWS KMS and allows retrieval at runtime through IAM-controlled API calls, keeping credentials out of the application code and environment variables. Option B is not appropriate because an S3 object, even with server-side encryption, is not a dedicated secrets-management service and would still require custom retrieval logic and careful access controls to avoid exposure. Option C is wrong because hardcoding credentials in a configuration file directly exposes them in source control and deployment artifacts. Option E is wrong because Elastic Beanstalk environment variables are visible in the console and configuration and are explicitly what the scenario wants to avoid.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store credentials in AWS Secrets Manager and retrieve them at runtime.
Why this is correct
AWS Secrets Manager encrypts secrets with KMS keys and provides a dedicated GetSecretValue API for runtime retrieval, so application code never contains or resolves the secret itself. It also supports automatic rotation of database credentials via Lambda, fine-grained IAM policies, and cross-account access, making it the most built-for-purpose option for dynamically fetching secrets in an Elastic Beanstalk environment.
- ✗
Store credentials in an Amazon S3 bucket with server-side encryption.
Why it's wrong here
S3 server-side encryption (SSE-S3 or SSE-KMS) protects data at rest, but using S3 as a secret store forces the application to manually perform a GET object request and parse the returned content, with no built-in secret rotation or dedicated secret access API. Access control requires intricate bucket policies and principal conditions, and deleted or overwritten secrets may remain recoverable in previous object versions unless lifecycle rules are configured. S3 is an object storage service, not a secrets manager, so it lacks the operational controls and runtime integration needed for production credentials.
- ✗
Hardcode credentials in the application configuration file.
Why it's wrong here
Hardcoding credentials in an application configuration file exposes them to anyone with access to the repository, artifact, or instance, and they are often accidentally committed to source control and retained in history indefinitely. Configuration files are frequently copied into logs, machine images, or debugging output, and rotating a hardcoded secret requires a new deployment and often a full code change. This practice directly violates AWS security best practices, which mandate that secrets be stored in a managed service and resolved at runtime.
- ✓
Store credentials in AWS Systems Manager Parameter Store with SecureString parameter type.
Why this is correct
SSM Parameter Store SecureString parameters are encrypted with AWS KMS and can be retrieved at runtime using the GetParameter API, enabling Elastic Beanstalk applications to obtain secrets without placing them in code or environment variables. It offers a hierarchical structure, support for IAM fine-grained access, and a lower cost compared to Secrets Manager, which makes it a valid alternative for many scenarios. However, it does not natively provide automatic secret rotation; if rotation is required, you would need to pair it with Secrets Manager or build custom logic, but as a standalone secure secret store it is acceptable.
- ✗
Store credentials as environment variables in the Elastic Beanstalk environment.
Why it's wrong here
Elastic Beanstalk environment variables are set as plain text in the environment configuration and are visible to any user with EB management permissions; they are also passed directly to the application process and can be exposed via stack traces, logs, or /proc/self/environ on the underlying EC2 instance. They do not support per-secret IAM access, are not encrypted by default, and rotation requires a full environment redeployment or configuration update. Therefore, they should be used only for non-sensitive configuration settings, not for database passwords or API keys.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.