DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS CloudHSM

  Why it's wrong here

  AWS CloudHSM provides dedicated hardware security modules for cryptographic operations and secure key storage, meeting stringent compliance requirements. While it offers a highly secure environment for encryption keys, it is not designed for the direct storage, management, or automatic rotation of application-level secrets like database passwords. Its primary function is to provide FIPS 140-2 Level 3 validated hardware for cryptographic key management, not a secrets management service.

• ✓

  AWS Secrets Manager

  Why this is correct

  AWS Secrets Manager is purpose-built for securely storing, managing, and retrieving various types of secrets, including database credentials, API keys, and other sensitive data. Its key feature is native integration with services like Amazon RDS, enabling automatic rotation of database passwords on a schedule or on demand. This capability is crucial for enhancing security posture and meeting compliance requirements by regularly changing sensitive credentials.

• ✗

  AWS KMS

  Why it's wrong here

  AWS Key Management Service (KMS) is a managed service that makes it easy to create and control encryption keys used to encrypt your data across various AWS services and in your applications. While KMS is fundamental for encrypting the secrets themselves (Secrets Manager uses KMS under the hood for encryption), it does not directly store the secrets or provide features for their lifecycle management, such as automatic rotation or retrieval by applications. KMS manages keys, not the secrets content.

• ✗

  AWS Systems Manager Parameter Store

  Why it's wrong here

  AWS Systems Manager Parameter Store allows for secure storage of configuration data and secrets as parameters, including encrypted parameters using KMS. While it can store database passwords and is suitable for general configuration, it lacks native capabilities for automatic secret rotation, which is a critical security best practice for database credentials. Managing rotation would require custom automation and external scripting, making it less suitable than a dedicated secrets management service for this specific requirement.