DVA-C02 Development with AWS Services Practice Question
A developer needs to store application configuration data, such as database connection strings and API keys, for a microservices application running on Amazon ECS. The configuration must be encrypted at rest and easily auditable. Which AWS service should the developer use?
⚠ Common exam trap
Test-takers frequently confuse AWS Secrets Manager with Systems Manager Parameter Store, but Secrets Manager is specifically for secrets requiring automatic rotation, while Parameter Store is the appropriate choice for general configuration data that needs encryption and auditing without rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Systems Manager Parameter Store.
AWS Systems Manager Parameter Store is the correct choice because it is designed to store application configuration data like database connection strings and API keys, integrates natively with Amazon ECS for secure parameter retrieval, and supports encryption at rest using AWS KMS. It also provides built-in auditing through AWS CloudTrail, which logs all API calls to the Parameter Store, meeting the auditability requirement.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Secrets Manager.
Why it's wrong here
AWS Secrets Manager is primarily designed for managing, rotating, and auditing sensitive credentials like database passwords, API keys, and OAuth tokens. While it can store arbitrary strings, using it for general application configuration data, which typically does not require automated rotation or the advanced lifecycle management features, is often overkill. This approach leads to higher operational costs and unnecessary complexity compared to services optimized for non-secret configuration parameters.
- ✗
Amazon S3 with server-side encryption.
Why it's wrong here
Amazon S3 is a highly durable and scalable object storage service, suitable for storing static files, backups, and large data objects. Although configuration files can be stored in S3 with server-side encryption, it lacks native features essential for robust configuration management, such as automatic parameter versioning, secure retrieval by name, and direct integration with application deployment pipelines without custom parsing logic. Auditing changes to individual configuration values would require significant custom development.
- ✓
AWS Systems Manager Parameter Store.
Why this is correct
AWS Systems Manager Parameter Store is purpose-built for securely storing and managing application configuration data, including both plain-text and encrypted parameters. It offers hierarchical organization, automatic versioning of parameter changes, and seamless integration with AWS Key Management Service (KMS) for encryption. Its ability to retrieve parameters by name and integration with AWS CloudTrail for auditing all access and modifications makes it the ideal, cost-effective, and operationally simple choice for this use case.
- ✗
Amazon DynamoDB with encryption at rest.
Why it's wrong here
Amazon DynamoDB is a fully managed NoSQL database service optimized for high-performance, low-latency applications requiring massive scale. While it can technically store configuration data, leveraging a full-fledged database for simple application configuration introduces unnecessary operational overhead, schema management complexity, and potential over-provisioning of resources. It is an overly complex and expensive solution when a simpler, dedicated configuration management service like Parameter Store is available and more appropriate for the task.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.