DVA-C02 Security Practice Question
A developer needs to securely store database credentials for a serverless application. Which service should be used?
⚠ Common exam trap
DVA-C02 often tests the overlap between Parameter Store SecureString and Secrets Manager, baiting candidates who do not realize that automatic credential rotation is the decisive requirement that only Secrets Manager satisfies.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets such as database credentials, with native integration to RDS rotation Lambdas and fine-grained IAM access. It encrypts secrets with KMS and supports automatic rotation, which is the key differentiator for credential storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Secrets Manager
Why this is correct
Secrets Manager is purpose-built for credentials like database usernames and passwords: it encrypts secrets at rest with KMS, supports automatic rotation via built-in Lambda rotation functions for RDS/Aurora/DocumentDB, and integrates natively with Lambda through the SDK or a caching layer extension for fast, secure retrieval.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
Parameter Store can hold a SecureString and encrypt it with KMS, making it a viable option for simple configuration secrets, but it lacks Secrets Manager's built-in automatic rotation workflow for database credentials, making it a weaker fit for this specific use case than a purpose-built secrets service.
- ✗
Amazon S3
Why it's wrong here
Amazon S3 is a general-purpose object storage service with no built-in secret lifecycle management, automatic rotation, or fine-grained secret-level access auditing, making it an inappropriate and insecure place to store sensitive credentials compared to a dedicated secrets service.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
AWS KMS manages and safeguards the cryptographic keys used to encrypt and decrypt data, but it does not itself store or serve secret values like a database password; KMS is typically used underneath services like Secrets Manager to protect the secret material, not as the secret store itself.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.