DVA-C02 Security Practice Question
A developer needs to securely store database credentials and retrieve them programmatically from a Lambda function. Which AWS services can be used for this purpose? (Choose TWO.)
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager Parameter Store (SecureString)
Options A and B are correct. AWS Systems Manager Parameter Store (SecureString) and AWS Secrets Manager are both designed to securely store database credentials and other secrets, and allow programmatic retrieval from Lambda functions. AWS CloudFormation (option C) is for infrastructure as code, not for storing secrets. AWS IAM (option D) is for managing permissions, not for storing secrets. Amazon S3 (option E) is for object storage and is not a secure secrets management service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Systems Manager Parameter Store (SecureString)
Why this is correct
AWS Systems Manager Parameter Store SecureString parameters store database credentials as encrypted values using AWS KMS, and they can be retrieved through the AWS API, CLI, or SDK by services like EC2, ECS, and Lambda. However, while Parameter Store can integrate with KMS and supports versioning, it does not natively automate credential rotation, so it is best when you need encrypted secrets without the additional lifecycle features of Secrets Manager.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is purpose-built for storing database credentials, API keys, and other secrets, with automatic rotation via a Lambda function that can update not only the secret but also the database password if configured. It provides fine-grained permissions, cross-account access, and can generate random secrets, but it costs more per secret per month, so it is the recommended choice for production databases where rotation is a requirement.
- ✗
AWS CloudFormation
Why it's wrong here
AWS CloudFormation is an infrastructure-as-code service that provisions and manages AWS resources, not a store for secrets. You could embed a secret in a template or pass it as a parameter, but doing so risks exposing plaintext sensitive values and CloudFormation provides no encryption, retrieval, or rotation semantics; secrets should be kept in Parameter Store or Secrets Manager and referenced by ARN or name from CloudFormation.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
AWS Identity and Access Management (IAM) controls authentication and authorization for AWS principals and API actions; it is not a key-value store for application secrets. IAM users and roles have access keys and credentials that authenticate to AWS, but they are not intended to hold arbitrary database passwords, and IAM has no API to store and retrieve a secret by name with versioning or rotation.
- ✗
Amazon S3
Why it's wrong here
Amazon S3 is a distributed object storage service, and while you can place an encrypted object containing credentials, it lacks the secret management features needed for database credentials such as native retrieval APIs for secrets, generation, versioned lookup by name, and integrated rotation. Using S3 forces you to build custom encryption, access control, and stale-version handling, making it an inferior choice for this purpose compared with Parameter Store or Secrets Manager.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.