DVA-C02 Security Practice Question
A developer needs to securely store database credentials for a Lambda function. The credentials should be automatically rotated every 30 days. Which AWS service should the developer use?
⚠ Common exam trap
A common mix-up: candidates confuse AWS Systems Manager Parameter Store (which can store secrets with SecureString) with AWS Secrets Manager, but the key differentiator is that Secrets Manager provides built-in automatic rotation, which is explicitly required by the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager.
AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials and other secrets. It supports native rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in Lambda rotation functions, and can be configured to rotate on a schedule (e.g., every 30 days) without custom code. The service also integrates directly with Lambda via the AWS SDK to retrieve secrets at runtime, ensuring credentials are never hardcoded.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Key Management Service (KMS) to encrypt the credentials.
Why it's wrong here
AWS Key Management Service (KMS) is a cryptographic service primarily used for creating and managing encryption keys. While it can encrypt data, including credentials, it does not provide a mechanism for storing the encrypted credentials or, crucially, for automatically rotating them. Developers would still need to build a separate solution for secret storage and lifecycle management, making it an incomplete solution for secure credential management.
- ✗
Store the credentials in an IAM role's trust policy.
Why it's wrong here
Storing database credentials directly within an IAM role's trust policy is fundamentally incorrect and a severe security vulnerability. Trust policies define which principals are permitted to assume the role, not a secure storage location for sensitive data like database passwords. This approach exposes credentials in plain text or easily retrievable form, completely bypassing secure secret management best practices.
- ✓
AWS Secrets Manager.
Why this is correct
AWS Secrets Manager is the correct service for securely storing and managing database credentials because it is purpose-built for this task. It offers robust features like automatic rotation of credentials for supported databases, integration with other AWS services, and fine-grained access control. This automation significantly reduces the operational burden and enhances security by ensuring credentials are regularly updated without manual intervention.
- ✗
AWS Systems Manager Parameter Store with a SecureString parameter.
Why it's wrong here
AWS Systems Manager Parameter Store with a SecureString parameter can securely store encrypted sensitive data, including credentials, but it lacks the critical feature of automatic credential rotation. While it provides encryption at rest and in transit, developers would be responsible for manually implementing and managing any rotation mechanism. This manual overhead makes it less suitable than Secrets Manager for database credentials requiring regular, automated updates to maintain security posture.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.