DVA-C02 Development with AWS Services Practice Question
A developer needs to securely store database credentials for a Lambda function that accesses an Amazon RDS instance. The credentials must be automatically rotated every 30 days. Which AWS service should be used?
⚠ Common exam trap
Candidates often choose Parameter Store because it is cheaper and can store secrets, but it lacks native rotation scheduling for RDS credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is specifically designed to securely store, manage, and automatically rotate database credentials for services like Amazon RDS. It supports built-in rotation with a configurable schedule (e.g., every 30 days) using a Lambda rotation function, and it integrates directly with RDS to update credentials without manual intervention. This meets the requirement for automatic rotation and secure storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS IAM Roles for Lambda
Why it's wrong here
AWS IAM Roles define permissions for AWS entities, allowing them to perform actions on resources by assuming temporary credentials. While crucial for access control, an IAM role itself does not function as a secure vault for storing static database credentials. It facilitates *access* to resources, but does not *store* the sensitive strings like usernames and passwords that the Lambda function would then use to connect to a database.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is purpose-built for securely storing, managing, and retrieving sensitive information such as database credentials, API keys, and other secrets. It offers critical security features like automatic rotation of secrets, which is essential for enhancing security posture and reducing the risk of compromise. Furthermore, Secrets Manager provides fine-grained access control and integrates seamlessly with various AWS services and databases for streamlined secret management.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
AWS Key Management Service (KMS) is a service designed to create and manage cryptographic keys, which are used to encrypt and decrypt data. While KMS is fundamental for securing data at rest and in transit, it does not directly store the actual database credentials. A developer would use KMS to encrypt a secret, but a separate service would still be required to store the encrypted secret string itself, making KMS an encryption engine rather than a secret storage solution.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store allows for secure storage of configuration data and secrets as `SecureString` parameters, encrypted using KMS. However, a key limitation for managing database credentials is its lack of native automatic rotation capabilities, which is a critical security best practice for mitigating the risk of long-lived secrets. While suitable for many configuration parameters, it requires custom solutions for secret rotation, unlike the integrated functionality offered by Secrets Manager.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.