DVA-C02 Security Practice Question
A company is using AWS Lambda functions that access an RDS database. Which THREE practices should be followed to secure the database credentials?
⚠ Common exam trap
A common mix-up: candidates confuse network-level controls (security groups) with cryptographic operations, or assume that encrypting environment variables with KMS is sufficient, overlooking that Secrets Manager provides rotation and centralized audit capabilities that KMS alone does not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Secrets Manager to store and automatically rotate the credentials.
Option A is correct because AWS Secrets Manager is purpose-built to store database credentials securely and can automatically rotate RDS credentials on a schedule using a Lambda rotation function, eliminating hard-coded or long-lived secrets. Option C is correct because Lambda environment variables can be encrypted at rest with an AWS KMS customer managed key, so credentials are not stored in plaintext and the function decrypts them at runtime using its execution role permissions. Option E is correct because placing the Lambda function in the same VPC as the RDS instance and using a security group to permit traffic only to the database port (e.g., 3306 for MySQL or 5432 for PostgreSQL) restricts network access to the database. Option B is incorrect because security groups are stateful virtual firewalls that filter network traffic; they do not decrypt credentials. Option D is incorrect because embedding credentials in Lambda function code exposes them in source control, deployment packages, and logs, which is an insecure anti-pattern.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Secrets Manager to store and automatically rotate the credentials.
Why this is correct
AWS Secrets Manager is a dedicated service designed for securely storing, managing, and automatically rotating credentials, API keys, and other secrets. By integrating with Secrets Manager, Lambda functions can retrieve the latest database credentials at runtime using an IAM role, eliminating the need to hardcode or embed them. This approach enhances security by centralizing secret management and enforcing regular credential rotation, significantly reducing the risk of compromise.
- ✗
Use a security group to decrypt the credentials.
Why it's wrong here
Security groups function as virtual firewalls that control inbound and outbound network traffic for EC2 instances, ENIs, and other network-attached resources within a VPC. Their sole purpose is to filter network packets based on IP addresses and port numbers, determining what traffic is allowed or denied. Security groups possess no cryptographic capabilities and cannot perform operations like decrypting credentials; this functionality is entirely outside their operational scope.
- ✓
Encrypt the credentials using AWS KMS and pass them as encrypted environment variables to Lambda.
Why this is correct
Encrypting credentials using AWS Key Management Service (KMS) and passing them as encrypted environment variables to a Lambda function is a robust security practice. The credentials are encrypted client-side before deployment using a KMS key, and the Lambda execution environment, assuming it has the necessary IAM permissions, decrypts them automatically at runtime. This method ensures that sensitive data remains encrypted at rest within the Lambda configuration and is only decrypted in the secure, isolated execution environment.
- ✗
Store the credentials in the Lambda function code.
Why it's wrong here
Storing credentials directly within the Lambda function code is a highly insecure practice that introduces multiple vulnerabilities. Hardcoding secrets exposes them in source control repositories, deployment packages, and potentially in logs, making them easily discoverable by unauthorized individuals. Furthermore, this approach complicates credential rotation, as any change requires modifying and redeploying the function code, increasing operational overhead and the risk of errors.
- ✓
Place the Lambda function inside a VPC and use a security group to allow access to RDS.
Why this is correct
Placing a Lambda function inside a Virtual Private Cloud (VPC) is essential when it needs to access resources like an RDS database that are not publicly accessible. This ensures that the communication between the Lambda function's Elastic Network Interface (ENI) and the RDS instance's ENI occurs entirely within the private AWS network, rather than traversing the public internet. A security group then acts as a network-level firewall, specifically allowing the Lambda function's outbound traffic to reach the RDS instance on the required database port, enforcing network isolation and access control.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 1,135-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.