DVA-C02 Deployment Practice Question
A developer is deploying a serverless application using the AWS Serverless Application Model (SAM). The developer wants to ensure that the Lambda function's environment variables are encrypted at rest. What is the most straightforward way to achieve this?
⚠ Common exam trap
It's easy for candidates to assume they must explicitly enable encryption or use a custom KMS key, overlooking that Lambda automatically encrypts environment variables at rest by default with an AWS managed key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
No action needed; SAM automatically encrypts environment variables at rest using a default KMS key.
AWS SAM, by default, encrypts Lambda function environment variables at rest using an AWS managed KMS key (aws/lambda). This is a built-in behavior of the Lambda service, so no additional configuration is required in the SAM template to achieve encryption at rest. The developer does not need to take any action beyond deploying the function.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
No action needed; SAM automatically encrypts environment variables at rest using a default KMS key.
Why this is correct
AWS Lambda automatically encrypts environment variables at rest using an AWS Key Management Service (KMS) key. When deploying a serverless application with SAM, this default behavior applies, meaning the environment variables specified in your SAM template are automatically encrypted by an AWS-managed KMS key without any explicit configuration. Therefore, no additional action is required from the developer to ensure these variables are encrypted while stored.
- ✗
Enable encryption in the SAM template using the 'Encrypt' property.
Why it's wrong here
This option is incorrect because there is no specific 'Encrypt' property or similar configuration directly within the AWS SAM template syntax that needs to be set to enable environment variable encryption. AWS Lambda, which SAM deploys to, handles the encryption of environment variables at rest automatically as a built-in security feature. Attempting to use a non-existent property would result in a deployment error.
- ✗
Modify the Lambda function's code to encrypt environment variables before deployment.
Why it's wrong here
Modifying the Lambda function's code to manually encrypt environment variables before deployment is unnecessary and introduces significant complexity. AWS Lambda already provides automatic encryption of environment variables at rest, making any in-code encryption redundant. Furthermore, implementing custom encryption would require the developer to manage decryption logic within the function, securely handle encryption keys, and potentially expose sensitive information during runtime if not implemented perfectly.
- ✗
Create a customer managed KMS key and specify it in the SAM template.
Why it's wrong here
While it is technically possible to specify a Customer Managed Key (CMK) for encrypting Lambda environment variables by configuring the 'KmsKeyArn' property in the Lambda function's resource definition within the SAM template, this is not a required action for basic encryption. The question asks what action is needed, and since encryption occurs automatically with an AWS-managed key by default, creating and specifying a CMK adds an unnecessary step unless specific compliance or key management requirements dictate its use.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.