Question 921 of 724
DVA-C02 Security Practice Question
A developer stores database credentials in Secrets Manager. The application sometimes receives AccessDeniedException from Lambda after secret rotation. What should be checked first?
⚠ Common exam trap
The trap here is that candidates may overlook the KMS key policy and focus only on the Lambda execution role, but the AccessDeniedException can also stem from the KMS key not authorizing the Lambda role to decrypt the secret, especially when using a customer-managed key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Whether the Lambda execution role and KMS key policy allow access to the new secret version and key
The AccessDeniedException from Lambda after secret rotation indicates that the Lambda function cannot access the new secret version. This is most commonly caused by the Lambda execution role lacking the necessary permissions (e.g., secretsmanager:GetSecretValue) for the new secret version ARN, or the KMS key policy not granting the Lambda role access to decrypt the secret using the customer-managed KMS key. Checking these two policies first is the correct troubleshooting step because rotation creates a new version with a different ARN, and the IAM policy must allow access to all versions or use a wildcard.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Whether API Gateway caching is enabled
Why it's wrong here
API Gateway caching is a frontend optimization feature designed to improve the performance and reduce the load on backend services by storing responses at the API Gateway level. However, the core problem described involves a backend process, likely a Lambda function, retrieving database credentials from AWS Secrets Manager. Enabling or disabling API Gateway caching has no direct bearing on the Lambda function's ability to successfully retrieve or utilize those credentials, making it irrelevant to the stated requirement.
- ✓
Whether the Lambda execution role and KMS key policy allow access to the new secret version and key
Why this is correct
When a Lambda function attempts to retrieve a secret from AWS Secrets Manager, it requires specific IAM permissions. The Lambda execution role must possess `secretsmanager:GetSecretValue` permission for the target secret. Furthermore, if the secret is encrypted using a customer-managed AWS Key Management Service (KMS) key, the Lambda execution role must also be granted `kms:Decrypt` permission on that specific KMS key. Without these explicit permissions on both the role and the KMS key policy, especially for new secret versions or keys, access will be denied.
- ✗
Whether the VPC has exactly three subnets
Why it's wrong here
The specific number of subnets within a Virtual Private Cloud (VPC) is a network design choice that typically influences high availability or segmentation, but it does not directly control a Lambda function's ability to access AWS Secrets Manager. While a Lambda function might be configured within a VPC to access private resources like a database, its interaction with Secrets Manager, an AWS service endpoint, is primarily governed by IAM permissions and network connectivity (e.g., VPC endpoints for Secrets Manager), not the exact count of subnets.
- ✗
Whether CloudFront invalidation completed
Why it's wrong here
CloudFront invalidation is a mechanism used to remove cached content from CloudFront edge locations, ensuring that users receive the latest version of static assets or dynamic content served through the CDN. This process is entirely distinct from the backend operation of a developer storing and a Lambda function retrieving database credentials from AWS Secrets Manager. CloudFront's caching and invalidation behavior has no functional relationship with the security or accessibility of secrets managed within Secrets Manager.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.