DVA-C02 Development with AWS Services Practice Question
A developer needs to store application configuration data, such as database connection strings and third-party API keys, securely. The data must be encrypted at rest and automatically rotated. Which AWS service should the developer use?
⚠ Common exam trap
Many candidates confuse AWS Systems Manager Parameter Store (which can store secrets with encryption but lacks automatic rotation) with AWS Secrets Manager, overlooking the explicit requirement for automatic rotation in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is specifically designed to securely store, encrypt, and automatically rotate secrets such as database connection strings and API keys. It integrates with AWS KMS for encryption at rest and provides built-in rotation capabilities for supported services like Amazon RDS, Redshift, and DocumentDB, meeting the requirement for automatic rotation without custom code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3 with server-side encryption
Why it's wrong here
Amazon S3, while offering server-side encryption, is fundamentally an object storage service and lacks the specialized features required for robust secret management. It does not provide native capabilities for automatic secret rotation, versioning specific to credential changes, or direct integration with application credential providers. Storing secrets in S3 would necessitate complex custom logic for retrieval, decryption, and manual rotation processes, which is prone to errors and less secure than dedicated secret management solutions.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
AWS Key Management Service (KMS) is a foundational service designed for creating and managing cryptographic keys (Customer Master Keys - CMKs) used to encrypt data. It is not a secret storage or management service itself; rather, it provides the encryption layer that other services, including AWS Secrets Manager and AWS Systems Manager Parameter Store, utilize to protect sensitive data. KMS does not store the actual secret values, nor does it offer features like automatic secret rotation, lifecycle management, or direct application integration for credential retrieval.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store can store sensitive data as 'SecureString' parameters, which are encrypted using AWS KMS, making it suitable for storing configuration data securely. However, its primary design is for configuration management, not dynamic secret lifecycle management. Parameter Store lacks built-in capabilities for automatic secret rotation, versioning specifically tied to secret rotation events, or seamless integration with database and service credential providers, making it less suitable for secrets requiring frequent, automated changes.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is purpose-built for securely storing, retrieving, and rotating various types of secrets, including database credentials, API keys, and other sensitive configuration data, throughout their entire lifecycle. It offers robust features such as automatic rotation for many AWS services (e.g., RDS, Redshift, DocumentDB) and custom secrets, fine-grained access control, comprehensive auditing, and seamless integration with applications for dynamic credential retrieval, making it the optimal solution for managing application configuration data that requires secure handling and automated rotation.
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.