DVA-C02 Security Practice Question
A developer needs to securely store database credentials and retrieve them programmatically from a Lambda function. Which AWS services can be used for this purpose? (Choose TWO.)
⚠ Common exam trap
DVA-C02 often tests the confusion between services that store secrets (Secrets Manager, Parameter Store SecureString) and services that merely authorize or provision (IAM, CloudFormation) — candidates must pick the storage services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager Parameter Store (SecureString)
AWS Systems Manager Parameter Store (SecureString) [CORRECT] is right because it stores sensitive values like database credentials as encrypted parameters using KMS, and a Lambda function can retrieve them programmatically via the GetParameter API with the WithDecryption flag set to true. AWS Secrets Manager [CORRECT] is also right because it is purpose-built for storing and rotating secrets such as database credentials, and Lambda can retrieve them programmatically using the GetSecretValue API. AWS CloudFormation does not belong because it is an infrastructure-as-code service for provisioning resources, not a secrets store for runtime retrieval. AWS Identity and Access Management (IAM) does not belong because it manages permissions and identities, not the storage of credential values themselves. Amazon S3 does not belong because it is object storage and, while it can hold files, it is not designed as a secure credential store with native secret-retrieval APIs for this use case.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Systems Manager Parameter Store (SecureString)
Why this is correct
AWS Systems Manager Parameter Store SecureString parameters store database credentials as encrypted values using AWS KMS, and they can be retrieved through the AWS API, CLI, or SDK by services like EC2, ECS, and Lambda. However, while Parameter Store can integrate with KMS and supports versioning, it does not natively automate credential rotation, so it is best when you need encrypted secrets without the additional lifecycle features of Secrets Manager.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is purpose-built for storing database credentials, API keys, and other secrets, with automatic rotation via a Lambda function that can update not only the secret but also the database password if configured. It provides fine-grained permissions, cross-account access, and can generate random secrets, but it costs more per secret per month, so it is the recommended choice for production databases where rotation is a requirement.
- ✗
AWS CloudFormation
Why it's wrong here
AWS CloudFormation is an infrastructure-as-code service that provisions and manages AWS resources, not a store for secrets. You could embed a secret in a template or pass it as a parameter, but doing so risks exposing plaintext sensitive values and CloudFormation provides no encryption, retrieval, or rotation semantics; secrets should be kept in Parameter Store or Secrets Manager and referenced by ARN or name from CloudFormation.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
AWS Identity and Access Management (IAM) controls authentication and authorization for AWS principals and API actions; it is not a key-value store for application secrets. IAM users and roles have access keys and credentials that authenticate to AWS, but they are not intended to hold arbitrary database passwords, and IAM has no API to store and retrieve a secret by name with versioning or rotation.
- ✗
Amazon S3
Why it's wrong here
Amazon S3 is a distributed object storage service, and while you can place an encrypted object containing credentials, it lacks the secret management features needed for database credentials such as native retrieval APIs for secrets, generation, versioned lookup by name, and integrated rotation. Using S3 forces you to build custom encryption, access control, and stale-version handling, making it an inferior choice for this purpose compared with Parameter Store or Secrets Manager.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.