DVA-C02 Development with AWS Services Practice Question
A developer is building a serverless application using AWS Lambda functions that need to access an Amazon RDS database. Which of the following are best practices for managing database credentials? (Choose TWO.)
⚠ Common exam trap
Test-takers frequently assume storing credentials as encrypted environment variables (Option C) is sufficient, but the exam requires understanding that environment variables are not a secure secret management service and lack features like rotation and fine-grained access control that Parameter Store or Secrets Manager provide.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Systems Manager Parameter Store to store encrypted credentials.
AWS Systems Manager Parameter Store is a best practice for managing database credentials because it provides secure, encrypted storage for configuration data and secrets. By using Parameter Store with AWS KMS encryption, developers can store credentials separately from code and retrieve them at runtime via the AWS SDK, ensuring that sensitive information is not exposed in the function code or deployment artifacts.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Systems Manager Parameter Store to store encrypted credentials.
Why this is correct
Parameter Store can store encrypted parameters securely.
- ✓
Use AWS Secrets Manager to store and rotate credentials.
Why this is correct
Secrets Manager provides secure storage and automatic rotation.
- ✗
Store the credentials as Lambda environment variables.
Why it's wrong here
Environment variables can be seen in the Lambda console and are not encrypted by default.
- ✗
Hardcode the credentials in the Lambda function code.
Why it's wrong here
Hardcoding is insecure and not a best practice.
- ✗
Store the credentials in a file in the Lambda deployment package.
Why it's wrong here
Storing in the deployment package exposes credentials in the code repository.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.