DVA-C02 Security Practice Question
A developer needs to securely store database credentials used by an application running on EC2. Which AWS service should be used?
⚠ Common exam trap
Watch out — candidates often confuse AWS Systems Manager Parameter Store with Secrets Manager because both can store secrets, but Parameter Store does not support automatic rotation for database credentials, which is a key requirement for securely managing database credentials in production.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, rotating, and managing database credentials and other secrets throughout their lifecycle. It offers automatic rotation of credentials for Amazon RDS, Redshift, and DocumentDB with built-in integration, and it encrypts secrets at rest using AWS KMS. For an EC2 application, Secrets Manager can be accessed via the AWS SDK or CLI using IAM roles attached to the EC2 instance, ensuring credentials are never hardcoded or stored in plaintext.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is the optimal choice for securely storing and managing database credentials because it is purpose-built for secrets lifecycle management. It offers robust features such as automatic rotation of credentials, integration with various AWS databases like Amazon RDS, and fine-grained access control through AWS Identity and Access Management (IAM). This service ensures that credentials are automatically updated without requiring manual intervention, significantly enhancing security posture and reducing the risk of compromise.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store can store sensitive data using SecureString parameters, which are encrypted with AWS Key Management Service (KMS). However, its primary design is for configuration data and basic secret storage, lacking the advanced features crucial for database credentials. Unlike Secrets Manager, Parameter Store does not natively support automatic rotation of secrets, requiring manual or custom automation for credential updates, making it less suitable for dynamic, high-security requirements.
- ✗
Amazon S3
Why it's wrong here
Amazon S3 is an object storage service designed for storing and retrieving any amount of data, not for dedicated secret management. While S3 can store encrypted files containing credentials, it lacks the inherent capabilities for secret rotation, versioning specific to secrets, and direct integration with applications for secure credential retrieval. Implementing a secure secret management solution using S3 would require significant custom development for encryption, access control, and lifecycle management, which is an anti-pattern compared to purpose-built services.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
AWS Certificate Manager (ACM) is specifically designed for provisioning, managing, and deploying SSL/TLS certificates for AWS services and integrated applications. Its function is to secure network communications by handling public and private key pairs, ensuring data encryption in transit and verifying identity. ACM has no functionality for storing, rotating, or managing arbitrary application secrets like database usernames and passwords, making it entirely unsuitable for this use case.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.