DVA-C02 Security Practice Question
A developer needs to securely pass a secret API key to an AWS Lambda function. What is the MOST secure and recommended approach?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the API key in AWS Secrets Manager and retrieve it in the Lambda function code.
AWS Secrets Manager is a dedicated service for securely storing and managing secrets like API keys. It integrates natively with Lambda, allowing retrieval at runtime with minimal permissions using IAM roles. Option A (DynamoDB) is less secure because it requires managing encryption and access policies manually, and the secret might be exposed in query logs. Option B (hardcoding) is insecure as the key is visible in source code and version control. Option C (environment variables) can be viewed in the Lambda console and CloudWatch Logs, and they are not encrypted by default unless using encryption helpers. Therefore, Secrets Manager (Option D) is the most secure and recommended approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the API key in an Amazon DynamoDB table and query it from the Lambda function.
Why it's wrong here
Storing an API key in an Amazon DynamoDB table is not recommended for secure secret management. While DynamoDB encrypts data at rest, it lacks native features for secret lifecycle management, such as automatic rotation or fine-grained access control specifically for individual secrets. The API key would be stored as a regular data item, making it vulnerable if table-level permissions are overly permissive or if the data is accessed by unauthorized entities, as DynamoDB is designed for general data storage, not dedicated secret handling.
- ✗
Hardcode the API key in the Lambda function code.
Why it's wrong here
Hardcoding an API key directly into the Lambda function's source code is a severe security vulnerability and violates fundamental security best practices. This practice exposes the secret in version control systems, deployment packages, and potentially to anyone with access to the code repository or build artifacts. Furthermore, rotating the key requires code modification, redeployment, and increases the risk of downtime or errors, making it impractical for secure and agile operations.
- ✗
Store the API key in an environment variable of the Lambda function.
Why it's wrong here
Storing an API key in a Lambda environment variable is not a secure practice for sensitive information. Although environment variables are encrypted at rest by AWS Lambda, they are easily viewable in plain text by anyone with console access or sufficient IAM permissions to view Lambda function configurations. This visibility makes them unsuitable for highly sensitive secrets like API keys, as it bypasses the principle of least privilege and secure secret retrieval mechanisms, increasing the risk of exposure.
- ✓
Store the API key in AWS Secrets Manager and retrieve it in the Lambda function code.
Why this is correct
AWS Secrets Manager is the recommended and most secure service for storing and managing sensitive data like API keys. It encrypts secrets at rest and in transit, provides robust automatic rotation capabilities, and integrates seamlessly with AWS Lambda for secure retrieval via the AWS SDK. This approach ensures the API key is never exposed in plain text within the application code or configuration, adhering to security best practices and simplifying secret lifecycle management and auditing.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 1,135 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.