DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Secrets Manager

  Why this is correct

  AWS Secrets Manager enables automatic rotation of database credentials on a configurable schedule, satisfying the developer's need to avoid hard-coded secrets in Lambda environment variables. Its built-in integration with Amazon RDS, Redshift, and DocumentDB allows the Lambda function to retrieve current credentials at runtime via the GetSecretValue API, eliminating manual secret management.

• ✗

  AWS CloudHSM

  Why it's wrong here

  AWS CloudHSM provides dedicated hardware security modules (HSMs) for cryptographic operations and secure storage of encryption keys. While offering the highest level of security for keys, it is not designed as a direct secret management solution for application credentials like database usernames and passwords. Integrating applications to retrieve and manage database credentials directly from CloudHSM would be overly complex and inefficient, lacking the built-in rotation and simplified access patterns offered by dedicated secret managers.

• ✗

  AWS KMS

  Why it's wrong here

  AWS Key Management Service (KMS) is primarily a managed service for creating and controlling encryption keys used to encrypt data. While KMS can be used to encrypt sensitive data, including database credentials, it does not *store* the secrets themselves. A developer would still need to store the encrypted credentials in another service and then use KMS for decryption, which adds complexity and doesn't provide the automatic rotation or direct secret retrieval capabilities needed for efficient credential management.

• ✗

  Amazon DynamoDB

  Why it's wrong here

  Amazon DynamoDB is a high-performance NoSQL database service optimized for low-latency data access and scalability. Although one could technically store database credentials within a DynamoDB table, it lacks the specialized security features, automatic rotation capabilities, granular access controls, and comprehensive audit trails specifically designed for secret management. Using a general-purpose database for this purpose introduces unnecessary operational overhead and potential security vulnerabilities compared to a dedicated secrets management service.