DVA-C02 Security Practice Question
A company runs an application on Amazon EC2 that needs to securely store database credentials. The security team requires that credentials be automatically rotated every 30 days to reduce the risk of compromise. The application must be able to retrieve the credentials at startup without storing them in code or configuration files. Which AWS service should the developer use?
⚠ Common exam trap
Test-takers frequently confuse AWS Systems Manager Parameter Store (SecureString) with Secrets Manager, overlooking that Parameter Store lacks native automatic rotation, which is a key requirement in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is specifically designed to securely store, retrieve, and automatically rotate database credentials on a schedule (e.g., every 30 days) without requiring custom code. The application can retrieve credentials at startup via the Secrets Manager API using IAM permissions, eliminating the need to store secrets in code or configuration files. Secrets Manager natively supports automatic rotation for Amazon RDS, Redshift, and DocumentDB, and can be extended to other services via custom Lambda functions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is purpose-built for securely storing, managing, and automatically rotating sensitive application secrets, such as database credentials. It integrates directly with services like Amazon RDS to facilitate seamless, scheduled password rotation without requiring manual intervention, significantly enhancing security posture and reducing operational overhead. This capability directly addresses the requirement for automatic rotation.
- ✗
AWS Systems Manager Parameter Store (SecureString)
Why it's wrong here
AWS Systems Manager Parameter Store, particularly with SecureString parameters, offers a secure way to store configuration data and secrets by encrypting values using AWS KMS. While it provides secure storage and easy retrieval, it lacks the native capability for automatic secret rotation. Implementing rotation with Parameter Store would require custom scripting and external scheduling, making it less suitable for applications specifically needing automated rotation.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
AWS Key Management Service (KMS) is a managed service designed for creating and controlling encryption keys used to encrypt data across various AWS services and within your applications. KMS itself does not store application secrets like database passwords; rather, it provides the cryptographic keys that other services, such as Secrets Manager or Parameter Store, utilize to encrypt the secrets they manage. Its primary function is key management, not direct secret storage or rotation.
- ✗
AWS Identity and Access Management (IAM) roles
Why it's wrong here
AWS Identity and Access Management (IAM) roles are a fundamental security primitive that grants temporary, fine-grained permissions to AWS entities, such as EC2 instances, to access other AWS services. While crucial for securing access to AWS resources, IAM roles manage authorization to AWS APIs and services, not the storage or automated rotation of application-level secrets like database passwords. They enable an EC2 instance to *retrieve* a secret from Secrets Manager, but they do not *store* or *rotate* the secret itself.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer stores database credentials for an application running on Amazon EC2. The security team requires that the credentials be automatically rotated every 30 days to reduce the risk of compromise. Which AWS service should the developer use to store and automatically rotate the credentials?
easy- A.AWS Systems Manager Parameter Store
- ✓ B.AWS Secrets Manager
- C.AWS Key Management Service (KMS)
- D.IAM Roles for EC2
Why B: AWS Secrets Manager is the correct choice because it is specifically designed to securely store database credentials and other secrets, and it provides built-in, configurable automatic rotation (e.g., every 30 days) using AWS Lambda. This meets the security team's requirement without custom scripting or infrastructure management.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.