Question 401 of 724
DVA-C02 Security Practice Question
A developer needs to encrypt secrets (database passwords) that are used by an application running on EC2. The application retrieves the secrets at startup. Which combination of services provides the MOST secure and manageable solution?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the secrets in AWS Secrets Manager and use an IAM role to access them.
AWS Secrets Manager is designed specifically for managing secrets like database passwords, with built-in rotation capabilities and fine-grained access control via IAM roles. Option B is wrong because storing secrets in S3, even with KMS encryption, does not provide automatic rotation and adds complexity in managing access policies. Option C is wrong because AWS Systems Manager Parameter Store SecureString parameters lack native secret rotation (though can be custom scripted) and are less integrated than Secrets Manager for secrets management. Option D is wrong because hardcoding secrets in application code is insecure and violates best practices, as secrets can be exposed in code repositories or decompiled.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the secrets in AWS Secrets Manager and use an IAM role to access them.
Why this is correct
Secrets Manager provides automatic rotation and fine-grained access control.
- ✗
Encrypt the secrets with AWS KMS and store them in an S3 bucket with a bucket policy.
Why it's wrong here
Storing encrypted secrets in S3 with a bucket policy lacks a native mechanism for the EC2 application to securely retrieve and decrypt them without embedding a long-term credential in the application code or instance metadata. The correct solution uses AWS Systems Manager Parameter Store or Secrets Manager with an IAM role attached to the EC2 instance, which grants temporary, scoped access at startup. This option is tempting because S3 with KMS encryption is a common pattern for static data at rest, and it would be correct for storing encrypted configuration files that are manually retrieved by an administrator rather than by an application at runtime.
- ✗
Store the secrets in AWS Systems Manager Parameter Store with a SecureString parameter.
Why it's wrong here
Parameter Store does not automatically rotate secrets.
- ✗
Hardcode the secrets in the application code and encrypt the code.
Why it's wrong here
Hardcoding is insecure.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 20, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.