DVA-C02 Deployment Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Hardcode the credentials in the application code.

  Why it's wrong here

  Hardcoding credentials directly into application code is a severe security vulnerability. These credentials become embedded in source control repositories, deployment artifacts, and potentially accessible to anyone with code access, making them extremely difficult to rotate or revoke without redeploying the entire application. This practice violates the principle of least privilege and significantly increases the attack surface if the code repository or deployed application is compromised.

• ✗

  Store credentials in Elastic Beanstalk environment properties.

  Why it's wrong here

  Storing sensitive credentials directly in Elastic Beanstalk environment properties is not a secure practice. While these properties are passed to the application as environment variables, they can be easily viewed in the Elastic Beanstalk console, retrieved via API calls, and are often exposed in application logs or configuration files, making them vulnerable to unauthorized access. This method lacks robust encryption and access control mechanisms suitable for secrets management.

• ✗

  Store credentials in an Amazon S3 bucket with public read access.

  Why it's wrong here

  Storing credentials in an Amazon S3 bucket with public read access is an extremely dangerous security misconfiguration. Public read access means anyone on the internet can retrieve these credentials without any authentication or authorization, leading to an immediate and severe data breach. This completely negates any security and exposes sensitive information to the entire world, making it an unacceptable practice for any production environment.

• ✓

  Store credentials in AWS Secrets Manager and retrieve them at runtime.

  Why this is correct

  AWS Secrets Manager is the recommended and most secure service for storing and managing sensitive credentials. It encrypts secrets at rest and in transit, allows for automatic rotation of credentials, and provides fine-grained access control through AWS IAM policies, ensuring only authorized applications or services can retrieve them at runtime. This approach minimizes the exposure window and enhances the overall security posture by centralizing secret management.