DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Key Management Service (KMS)

  Why this is correct

  AWS KMS is the correct answer because it provides the encryption key management that secures secrets at rest. KMS creates and protects Customer Master Keys (CMKs) that can encrypt data keys via envelope encryption, and both Systems Manager Parameter Store and Secrets Manager rely on KMS to encrypt their stored secret values. While KMS itself is not a secrets repository, it is the foundational service that makes secure secret storage possible. For this legacy application, using KMS to encrypt secrets either directly or through integration with other AWS services satisfies the security requirement.

• ✗

  AWS Certificate Manager

  Why it's wrong here

  AWS Certificate Manager is incorrect because it exclusively manages SSL/TLS certificates and their associated private keys for network encryption (in transit), not application secrets such as database passwords or API keys. ACM automates certificate issuance, renewal, and deployment to AWS resources like ALBs and CloudFront, but it does not provide a general-purpose interface to store, retrieve, or rotate arbitrary secret values. The certificates ACM issues are meant to be publicly presented, so they are not considered private secrets. Therefore, ACM does not address the developer's need to secure secrets for the legacy application.

• ✗

  AWS CloudHSM

  Why it's wrong here

  AWS CloudHSM is incorrect because it offers hardware security modules that provide FIPS 140-2 validated, tamper-resistant hardware for cryptographic key operations, but it is designed for regulated workloads that require dedicated, customer-controlled HSM appliances. Using CloudHSM for simple secret storage is an operational overkill because you must manage the HSM cluster, partitions, and scaling yourself, whereas AWS KMS offers a fully managed equivalent. Additionally, CloudHSM does not natively store application secrets like passwords; it only protects the cryptographic keys used for encryption. For this use case, the fully managed and lower-complexity KMS service is the appropriate choice.

• ✓

  AWS Systems Manager Parameter Store

  Why this is correct

  Systems Manager Parameter Store is a correct option because it provides a secure, hierarchical store for configuration data and secrets, supporting plaintext and encrypted SecureString parameters. It integrates with AWS KMS to encrypt parameter values, making it suitable for storing database credentials, API keys, and other secrets with fine-grained AWS IAM access control. Parameter Store is a cost-effective and simple solution, especially for legacy applications, but it lacks advanced features like automatic secret rotation, which is available in Secrets Manager. Nonetheless, it enables the developer to securely store and retrieve secrets for the legacy application.

• ✓

  AWS Secrets Manager

  Why this is correct

  AWS Secrets Manager is a correct option because it is a purpose-built service for centralizing and managing secrets throughout their entire lifecycle, including database credentials, API keys, and other sensitive values. It automatically encrypts secrets using KMS, enforces resource-based and IAM policies, and supports built-in rotation via Lambda to regularly change credentials—a critical capability for legacy applications with hardcoded secrets. Secrets Manager also enables fine-grained access control and secret versioning. For securing a legacy application, Secrets Manager is the recommended, fully managed secrets management solution.

Go deeper

Related to this question