DVA-C02 Development with AWS Services Practice Question
A developer is deploying an AWS Lambda function that needs to access an Amazon RDS for MySQL database. The function runs in a private subnet and must connect without exposing credentials in code. The database credentials are stored in AWS Secrets Manager and rotate automatically. Which approach should the developer use to retrieve the credentials securely?
⚠ Common exam trap
The trap here is thinking that KMS-encrypted environment variables are equivalent to Secrets Manager, when environment variables cannot follow automatic rotation and remain static.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Grant the Lambda execution role permission to call secretsmanager:GetSecretValue and retrieve the secret at runtime using the AWS SDK.
Granting the Lambda execution role secretsmanager:GetSecretValue and retrieving the secret at runtime with the AWS SDK is the secure way to use rotating credentials without embedding them. The function always reads the current secret value, and access is controlled through IAM rather than static configuration.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use an Amazon RDS IAM database authentication token generated by the Lambda execution role instead of a password.
Why it's wrong here
IAM database authentication can replace passwords for RDS, but it requires the database user to be configured for IAM authentication and the token is short-lived. The scenario specifically states credentials are stored in Secrets Manager and rotate, so using IAM auth does not align with the stated design.
- ✗
Embed the credentials in the Lambda deployment package and use AWS CodeArtifact to store the package securely.
Why it's wrong here
Embedding credentials in the deployment package exposes them in code and artifact storage, and they will not reflect Secrets Manager rotation. CodeArtifact secures packages but does not make hardcoded secrets safe, so this approach violates the requirement.
- ✓
Grant the Lambda execution role permission to call secretsmanager:GetSecretValue and retrieve the secret at runtime using the AWS SDK.
Why this is correct
Attaching an IAM policy that allows secretsmanager:GetSecretValue to the Lambda execution role lets the function retrieve the current secret with temporary credentials. This avoids hardcoded credentials, respects rotation, and follows least-privilege access, so it is the secure and recommended approach.
- ✗
Store the database password in a Lambda environment variable and enable encryption with an AWS KMS key.
Why it's wrong here
Encrypting environment variables with KMS protects them at rest, but the password becomes stale when Secrets Manager rotates it, and environment variables are visible to anyone with function read access. It also does not leverage Secrets Manager rotation, so it fails the requirement.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.