DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Secrets Manager

  Why this is correct

  AWS Secrets Manager is the optimal choice for securely storing and managing database credentials because it is purpose-built for secrets lifecycle management. It offers robust features such as automatic rotation of credentials, integration with various AWS databases like Amazon RDS, and fine-grained access control through AWS Identity and Access Management (IAM). This service ensures that credentials are automatically updated without requiring manual intervention, significantly enhancing security posture and reducing the risk of compromise.

• ✗

  AWS Systems Manager Parameter Store

  Why it's wrong here

  AWS Systems Manager Parameter Store can store sensitive data using SecureString parameters, which are encrypted with AWS Key Management Service (KMS). However, its primary design is for configuration data and basic secret storage, lacking the advanced features crucial for database credentials. Unlike Secrets Manager, Parameter Store does not natively support automatic rotation of secrets, requiring manual or custom automation for credential updates, making it less suitable for dynamic, high-security requirements.

• ✗

  Amazon S3

  Why it's wrong here

  Amazon S3 is an object storage service designed for storing and retrieving any amount of data, not for dedicated secret management. While S3 can store encrypted files containing credentials, it lacks the inherent capabilities for secret rotation, versioning specific to secrets, and direct integration with applications for secure credential retrieval. Implementing a secure secret management solution using S3 would require significant custom development for encryption, access control, and lifecycle management, which is an anti-pattern compared to purpose-built services.

• ✗

  AWS Certificate Manager (ACM)

  Why it's wrong here

  AWS Certificate Manager (ACM) is specifically designed for provisioning, managing, and deploying SSL/TLS certificates for AWS services and integrated applications. Its function is to secure network communications by handling public and private key pairs, ensuring data encryption in transit and verifying identity. ACM has no functionality for storing, rotating, or managing arbitrary application secrets like database usernames and passwords, making it entirely unsuitable for this use case.