DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS CloudHSM

  Why it's wrong here

  AWS CloudHSM is a hardware security module (HSM) that provides tamper-resistant cryptographic key storage and cryptographic operations, not a service for storing arbitrary secrets like database passwords. To use it for secrets, you would need to design custom encryption/decryption logic and manage the application integration yourself. It is meant for regulatory compliance around key management, not as a general-purpose secret store.

• ✓

  AWS Systems Manager Parameter Store

  Why this is correct

  AWS Systems Manager Parameter Store is a secure, hierarchical service for storing configuration data and secrets, including database passwords, as String, StringList, or SecureString parameters. SecureString parameters are encrypted with AWS KMS and can be retrieved via the AWS SDK, CLI, or directly from EC2 and Lambda, with IAM policies controlling access. It is a low-cost, no-extra-fee option (beyond KMS) and supports versioning, making it a lightweight and practical choice when you don't need built-in automatic rotation.

• ✗

  AWS Identity and Access Management (IAM)

  Why it's wrong here

  AWS Identity and Access Management (IAM) is designed to manage identities, users, groups, roles, and permissions, not to store application secrets such as database passwords. IAM does store certain credentials (user login passwords and access keys), but it has no API for storing free-form key-value pairs or arbitrary secret values. Therefore, it cannot be used as a secret store for your application's database credentials, and trying to use IAM for this purpose is conceptually incorrect.

• ✓

  AWS Secrets Manager

  Why this is correct

  AWS Secrets Manager is a purpose-built service for managing secrets like database credentials, offering built-in automatic rotation via AWS Lambda, fine-grained IAM access control, and native integration with services like RDS, Redshift, and DocumentDB. It stores secrets encrypted by KMS and provides APIs specifically designed for secure retrieval at runtime. It is a correct choice when you need rotation, auditability, and cross-account secret sharing, although it incurs a monthly charge per secret, so for simple static secrets without rotation, Parameter Store may be more cost-effective.

• ✗

  Amazon S3

  Why it's wrong here

  Amazon S3 is object storage for files, media, backups, and other unstructured data, not a service designed for secrets management. While you could upload a file containing encrypted secrets, you would be responsible for managing encryption keys, access policies, versioning, and rotation yourself, and there is no native semantic for retrieving a single secret value as a parameter. Storing plaintext database passwords in S3 is a common anti-pattern that violates security best practices, so S3 is not a suitable or secure secret store.