DVA-C02 Security Practice Question
A developer needs to securely store database credentials for a serverless application. Which AWS service should be used?
⚠ Common exam trap
A common mix-up: candidates confuse AWS Systems Manager Parameter Store (which can store secrets but lacks automatic rotation and deep RDS integration) with AWS Secrets Manager, leading them to choose Parameter Store when the question explicitly requires secure storage and management of database credentials for a serverless application.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct service because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It integrates natively with Amazon RDS, Redshift, and DocumentDB to automatically rotate credentials, and it enforces encryption at rest using AWS KMS. For a serverless application, Secrets Manager provides a simple API call (e.g., GetSecretValue) to retrieve credentials without hardcoding them in code or environment variables.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
AWS Key Management Service (KMS) is designed for creating and managing cryptographic keys, which are used to encrypt data. While KMS can encrypt secrets, it does not store the secrets themselves or offer features like automatic rotation for credentials. It serves as an underlying encryption service rather than a dedicated secrets management solution, making it unsuitable for directly storing and rotating database credentials.
- ✗
Amazon DynamoDB
Why it's wrong here
Amazon DynamoDB is a highly scalable NoSQL database service primarily used for storing application data. Although one could technically store sensitive information within a DynamoDB table, it lacks the specialized security controls, auditing capabilities, and crucial automatic rotation features inherent to a dedicated secrets management service. Implementing a secure secrets solution with DynamoDB would require extensive custom development and maintenance, which is not its intended purpose.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is purpose-built for securely storing, managing, and retrieving sensitive credentials like database passwords, API keys, and other secrets. Its core functionality includes automatic rotation of secrets, which significantly enhances security by regularly changing credentials without requiring manual intervention. Additionally, it offers fine-grained access control, auditing through CloudTrail, and integration with other AWS services, making it the optimal choice for secure credential management.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store allows for secure storage of configuration data and secrets, including sensitive strings encrypted using AWS KMS. While it provides secure storage and hierarchical organization for parameters, it fundamentally lacks the native automatic secret rotation capability that is essential for robust database credential management. This absence of automated rotation means manual processes would be required to update credentials, increasing operational overhead and security risk.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.