DVA-C02 Development with AWS Services Practice Question
A developer needs to store application configuration that can be accessed by multiple microservices running on Amazon ECS. The configuration must be encrypted at rest and automatically rotate secrets. Which AWS service should be used?
⚠ Common exam trap
Candidates often confuse AWS Systems Manager Parameter Store and AWS Secrets Manager. While both can store encrypted data, only AWS Secrets Manager provides native, automatic rotation of secrets. If the exam question mentions 'automatically rotate secrets' as a requirement, AWS Secrets Manager is almost always the correct choice.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is specifically designed to protect secrets (such as database credentials, API keys, and OAuth tokens) and features built-in, automatic rotation of secrets using AWS Lambda. While AWS Systems Manager Parameter Store can store encrypted configuration data (using SecureString), it does not offer native automatic rotation capabilities; implementing rotation in Parameter Store requires custom integration and code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store is the ideal solution for storing application configuration due to its ability to securely store parameters as plain text or encrypted values. It supports versioning, hierarchical organization, and easy retrieval by applications, promoting consistent configuration across environments. Furthermore, it offers a cost-effective alternative to Secrets Manager for non-sensitive configuration data, while still providing robust access control and audit capabilities.
- ✗
AWS CloudFormation
Why it's wrong here
AWS CloudFormation is an Infrastructure as Code (IaC) service primarily used for defining, provisioning, and managing AWS resources. Its purpose is to automate the deployment of infrastructure stacks, not to serve as a runtime store for application configuration values. While CloudFormation can deploy services that *consume* configuration, it does not provide a mechanism for applications to dynamically retrieve or update their operational settings during execution.
- ✗
Amazon S3
Why it's wrong here
Amazon S3 is an object storage service suitable for storing static files, including configuration files, but it lacks the specialized features required for dynamic application configuration management. It does not natively offer parameter-style access, built-in versioning for individual parameter values, or automatic rotation capabilities for configuration data. Relying on S3 for frequently changing or sensitive application settings would require significant custom logic for retrieval, parsing, and lifecycle management.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is specifically engineered for managing sensitive credentials such as database passwords, API keys, and other secrets that require robust security and lifecycle management. Its core features include automatic rotation, fine-grained access control, and auditing, which are critical for secrets but often overkill for general application configuration. While technically capable of storing configuration, its higher cost and specialized feature set make it an inefficient choice for non-secret application parameters.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DVA-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A developer wants to store application configuration data that can be accessed by multiple microservices. The data is sensitive and should be encrypted at rest. Which AWS service should be used to meet these requirements?
easy- A.Amazon S3
- B.AWS Identity and Access Management (IAM)
- C.Amazon DynamoDB
- ✓ D.AWS Systems Manager Parameter Store
Why D: AWS Systems Manager Parameter Store provides a secure, hierarchical store for configuration data and secrets. It supports encryption at rest using AWS KMS, integrates with AWS IAM for fine-grained access control, and is designed for use by multiple microservices via the AWS SDK or CLI. This makes it the ideal choice for storing sensitive application configuration that must be encrypted at rest and accessed by distributed services.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.