DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Use IAM roles for pipeline actions instead of access keys.

  Why this is correct

  IAM roles provide temporary, short-lived credentials that are automatically rotated by AWS, significantly reducing the risk associated with long-lived access keys. When an AWS service like CodeBuild or CodeDeploy assumes an IAM role, it receives a temporary security token, eliminating the need to embed static credentials directly into pipeline configurations or source code. This aligns with the principle of least privilege and enhances security posture by preventing credential leakage and simplifying credential management.

• ✓

  Scan code dependencies for known vulnerabilities.

  Why this is correct

  Scanning code dependencies for known vulnerabilities, often referred to as Software Composition Analysis (SCA), is a critical "shift left" security practice. This involves analyzing third-party libraries and packages used in the application for publicly disclosed Common Vulnerabilities and Exposures (CVEs). Integrating tools like Amazon Inspector or other SAST/DAST solutions into the CI/CD pipeline helps identify and remediate security flaws early, preventing vulnerable code from reaching production environments and reducing potential attack surfaces.

• ✗

  Use CloudFront to distribute pipeline artifacts.

  Why it's wrong here

  CloudFront is a Content Delivery Network (CDN) designed to cache and distribute static and dynamic web content globally with low latency. Its primary purpose is to serve end-users efficiently, not to store or distribute internal pipeline artifacts between build stages. Storing pipeline artifacts in CloudFront offers no security or performance benefits for internal CI/CD processes, as artifacts are typically consumed by other AWS services within the same region, making Amazon S3 the appropriate and cost-effective solution for secure artifact storage.

• ✓

  Store database credentials in AWS Secrets Manager and retrieve them during deployment.

  Why this is correct

  AWS Secrets Manager provides a dedicated, secure service for storing, managing, and automatically rotating sensitive information like database credentials, API keys, and other secrets. By retrieving credentials programmatically during deployment, applications avoid hardcoding secrets in source code or configuration files, significantly reducing the risk of exposure. Secrets Manager encrypts secrets at rest and in transit, offers fine-grained access control through IAM, and integrates with other AWS services to enhance overall security and compliance.

• ✗

  Encrypt artifacts in transit using TLS.

  Why it's wrong here

  Encrypting artifacts in transit using TLS (Transport Layer Security) is a fundamental security measure that AWS services inherently implement for all data transfers over public networks. When interacting with AWS APIs or transferring data between services like S3, CodeBuild, or CodeDeploy, TLS/SSL is automatically used to establish secure, encrypted communication channels. Therefore, explicitly stating "encrypt artifacts in transit using TLS" is redundant as it's a default, built-in security feature rather than an additional best practice a developer needs to implement.

Go deeper

Related to this question