DVA-C02 Development with AWS Services Practice Question
A developer is deploying a containerized application on Amazon ECS using Fargate. The application needs to store sensitive configuration data, including database passwords, that must be rotated regularly. Which service should the developer use to manage these secrets securely?
⚠ Common exam trap
Watch out — candidates often confuse AWS Systems Manager Parameter Store (which can store secrets but lacks native rotation) with AWS Secrets Manager, overlooking the explicit requirement for 'regular rotation' in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating sensitive configuration data such as database passwords. It integrates natively with Amazon ECS (via the `secrets` container definition parameter) and supports automatic rotation using AWS Lambda, which meets the requirement for regular rotation without custom code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3 with server-side encryption
Why it's wrong here
S3 with server-side encryption stores objects but provides no secret rotation, no automatic credential versioning and no native ECS task-definition injection. It suits static asset storage, whereas the scenario's rotation requirement points to a dedicated secrets management service.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager stores the database passwords and supports automatic rotation through Lambda rotation functions, meeting the regular-rotation requirement. ECS Fargate tasks retrieve secrets at launch via the secrets parameter, so credentials never persist in task definitions or images.
- ✗
Amazon DynamoDB with server-side encryption
Why it's wrong here
DynamoDB is a key-value database, not a secrets store; server-side encryption protects data at rest but offers no rotation mechanism, versioning for credentials or native ECS injection. It would be the choice for application state, not for managing database passwords.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
Parameter Store holds configuration values and supports SecureString, but its built-in rotation requires a Lambda function and applies to RDS credentials rather than arbitrary secrets. Secrets Manager provides native scheduled rotation for database passwords, which is the requirement here.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 1,135-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.