DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Systems Manager Parameter Store

  Why it's wrong here

  AWS Systems Manager Parameter Store can securely store sensitive data using AWS Key Management Service (KMS) encryption, making it suitable for general configuration parameters and some secrets. However, it does not offer native, automatic secret rotation capabilities for database credentials or API keys, which is a critical security best practice for minimizing the impact of compromised secrets. Implementing rotation would require custom Lambda functions and additional operational overhead, making it less ideal for secrets requiring frequent, automated lifecycle management compared to a dedicated service.

• ✗

  AWS CloudFormation template parameters

  Why it's wrong here

  AWS CloudFormation template parameters are designed for passing configuration values into a stack during deployment, not for securely storing sensitive information like database passwords or API keys. These parameters are typically visible in plain text within the CloudFormation console, API calls, or stack events, making them highly insecure for secrets. They lack the robust encryption, access controls, and lifecycle management features essential for protecting sensitive credentials throughout their operational lifespan.

• ✗

  Amazon DynamoDB with encryption at rest

  Why it's wrong here

  Amazon DynamoDB, while a highly secure and scalable NoSQL database with encryption at rest, is not purpose-built for secrets management. It lacks the specialized features crucial for handling secrets, such as automatic rotation for various credential types, built-in secret generation, fine-grained access policies tailored for secret retrieval, and integration with application runtime environments for secure secret injection. Using DynamoDB for secrets would necessitate significant custom development to replicate the functionality offered by a dedicated secrets manager.

• ✓

  AWS Secrets Manager

  Why this is correct

  AWS Secrets Manager is purpose-built for securely storing, managing, and retrieving secrets throughout their lifecycle, making it the optimal choice for applications. It natively supports automatic rotation for various types of credentials, including database passwords (e.g., RDS, Redshift, DocumentDB) and API keys, significantly enhancing security by regularly changing secrets without requiring application code changes. Furthermore, it provides fine-grained access control, auditing capabilities, and seamless integration with other AWS services like CodeDeploy and Lambda for secure secret injection and retrieval.

Go deeper

Related to this question