DVA-C02 Development with AWS Services Practice Question
A developer is building a serverless application using AWS Lambda to process events from Amazon S3. The Lambda function needs to persist data to an Amazon RDS MySQL database. Which of the following is the MOST secure way to pass database credentials to the Lambda function?
⚠ Common exam trap
The trap here is that candidates may believe IAM database authentication (Option B) is not supported for RDS MySQL, but it is actually supported for MySQL 5.7 and 8.0. However, the question asks for the 'MOST secure' method. While IAM database authentication is secure, AWS Secrets Manager provides additional benefits such as automatic credential rotation, fine-grained access control, and audit logging, making it the most secure and recommended approach for managing database credentials in a serverless application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the credentials in AWS Secrets Manager and retrieve them in the Lambda function code.
AWS Secrets Manager provides a secure, auditable, and automated way to store and retrieve database credentials. The Lambda function can assume an IAM role with permissions to access the secret, and retrieve the credentials at runtime using the AWS SDK, avoiding hardcoding or insecure storage. This approach also supports automatic rotation of credentials, enhancing security.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the credentials in an S3 bucket with server-side encryption and read them in the Lambda function.
Why it's wrong here
Requires managing access and lacks rotation.
- ✗
Use IAM database authentication for MySQL and assign an IAM role to the Lambda function.
Why it's wrong here
IAM auth is not supported for MySQL RDS, only for Aurora MySQL.
- ✗
Hardcode the credentials as environment variables in the Lambda function configuration.
Why it's wrong here
Hardcoding credentials as environment variables in the Lambda function configuration exposes the plaintext secrets in the AWS Management Console, CloudFormation templates, and version history, violating the principle of least privilege for the RDS MySQL database. This approach is tempting because environment variables are the standard mechanism for injecting configuration into Lambda at deployment time, and they would be correct for non-sensitive settings such as stage names or feature flags.
- ✓
Store the credentials in AWS Secrets Manager and retrieve them in the Lambda function code.
Why this is correct
Secrets Manager provides secure storage and automatic rotation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer is building a serverless application using AWS Lambda functions that need to access an Amazon RDS database. Which of the following are best practices for managing database credentials? (Choose TWO.)
medium- ✓ A.Use AWS Systems Manager Parameter Store to store encrypted credentials.
- ✓ B.Use AWS Secrets Manager to store and rotate credentials.
- C.Store the credentials as Lambda environment variables.
- D.Hardcode the credentials in the Lambda function code.
- E.Store the credentials in a file in the Lambda deployment package.
Why A: AWS Systems Manager Parameter Store is a best practice for managing database credentials because it provides secure, encrypted storage for configuration data and secrets. By using Parameter Store with AWS KMS encryption, developers can store credentials separately from code and retrieve them at runtime via the AWS SDK, ensuring that sensitive information is not exposed in the function code or deployment artifacts.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.