DVA-C02 Development with AWS Services Practice Question
A developer is writing an AWS Lambda function that needs to read a secret from AWS Secrets Manager. The function is written in Python. What is the BEST practice for retrieving the secret?
⚠ Common exam trap
Many candidates think retrieving the secret inside the handler (Option B) is simpler or more reliable, but they overlook the performance and cost implications of repeated API calls, as well as the Lambda execution environment reuse model that makes caching outside the handler both safe and efficient.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retrieve the secret outside the handler function and cache it in a global variable.
The best practice because retrieving the secret outside the handler function (at initialization time) and caching it in a global variable avoids making a Secrets Manager API call on every invocation. This reduces latency, cost, and the risk of hitting API rate limits. The cached value persists across warm starts within the same execution environment, aligning with AWS Lambda's lifecycle best practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Systems Manager Parameter Store to store the secret.
Why it's wrong here
While AWS Systems Manager Parameter Store can store sensitive data, AWS Secrets Manager is the purpose-built service for managing, retrieving, and rotating database credentials, API keys, and other secrets throughout their lifecycle. Secrets Manager offers robust features like automatic rotation, fine-grained access control, and integration with other AWS services, making it the more secure and comprehensive solution for secrets management compared to Parameter Store, which is better suited for configuration data.
- ✗
Retrieve the secret inside the handler function every time it is invoked.
Why it's wrong here
Retrieving a secret from a service like AWS Secrets Manager or Parameter Store within the Lambda handler function on every invocation introduces unnecessary network latency and API call costs. Lambda functions often reuse execution environments (warm starts), making repeated secret retrieval inefficient and detrimental to performance, especially for high-volume applications, as it adds overhead to each request instead of leveraging the cached environment.
- ✗
Store the secret in an environment variable.
Why it's wrong here
Storing secrets directly in Lambda environment variables is not a secure practice because these variables are accessible to anyone with permissions to view the Lambda function's configuration. Although AWS encrypts environment variables at rest, they are decrypted during execution and can be exposed through logs, debugging tools, or if the execution environment is compromised, making them unsuitable for sensitive credentials.
- ✓
Retrieve the secret outside the handler function and cache it in a global variable.
Why this is correct
Retrieving secrets outside the handler function, typically during the Lambda function's initialization phase, and caching them in a global variable is an optimal strategy for performance and cost efficiency. This approach ensures the secret is fetched only once per execution environment (during a cold start) and then reused for subsequent invocations (warm starts), significantly reducing latency and API call costs associated with repeated secret retrieval.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.