Courseiva
← DVA-C02
Full test
Development with AWS Services →easyMultiple ChoiceObjective-mapped

DVA-C02 Development with AWS Services Practice Question

A developer wants to store application configuration securely and retrieve it programmatically from EC2 instances. The configuration includes database passwords and API keys. Which AWS service should be used?

⚠ Common exam trap

Many exam-takers confuse EC2 user data (which is easy to use but insecure) with a proper secrets management service, overlooking that Parameter Store provides encryption, access control, and audit logging essential for production security.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

AWS Systems Manager Parameter Store with SecureString

AWS Systems Manager Parameter Store with SecureString is the correct choice because it is purpose-built for securely storing sensitive configuration data like database passwords and API keys. It integrates with AWS KMS for encryption at rest, supports versioning, and allows EC2 instances to retrieve values via the AWS CLI or SDK using IAM roles, eliminating the need to hardcode secrets.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

  • ✗

    EC2 user data

    Why it's wrong here

    EC2 user data is primarily designed for bootstrapping scripts executed only once when an instance launches. While it can pass initial configuration, any data placed in user data is stored unencrypted and is easily retrievable via the EC2 instance metadata service or visible in the EC2 console, making it inherently insecure for storing sensitive application secrets like API keys or database credentials. It lacks features for secure runtime retrieval or rotation.

  • ✗

    Amazon S3 with server-side encryption

    Why it's wrong here

    Although Amazon S3 offers robust server-side encryption options (e.g., SSE-KMS) to protect data at rest, it is fundamentally a general-purpose object storage service, not a dedicated secret management solution. Storing application configuration or secrets in S3 would require implementing custom mechanisms for secure retrieval, decryption, and access control within the application itself, which introduces complexity and potential security vulnerabilities compared to purpose-built secret stores.

  • ✗

    AWS CloudFormation template parameters

    Why it's wrong here

    CloudFormation template parameters are intended for customizing infrastructure deployments by providing input values at stack creation or update time. They are not designed for applications to securely retrieve sensitive runtime configuration values dynamically. While CloudFormation supports the NoEcho attribute to mask sensitive parameter values in console output, this does not provide secure storage or a secure runtime retrieval mechanism for application secrets.

  • ✓

    AWS Systems Manager Parameter Store with SecureString

    Why this is correct

    AWS Systems Manager Parameter Store, specifically when utilizing the SecureString data type, provides a highly secure and scalable solution for storing sensitive application configuration and secrets. SecureString encrypts parameter values using AWS Key Management Service (KMS) customer master keys, ensuring data is protected at rest and in transit. It offers fine-grained IAM access control, versioning, and seamless integration with EC2 instances and other AWS services for secure runtime retrieval without hardcoding credentials.

About these practice questions

One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →

How Courseiva writes practice questions · Editorial policy

Same concept, more angles

1 more way this is tested on DVA-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A developer needs to store application configuration data, such as database connection strings and API keys, for a microservices application running on Amazon ECS. The configuration must be encrypted at rest and easily auditable. Which AWS service should the developer use?

easy
  • A.AWS Secrets Manager.
  • B.Amazon S3 with server-side encryption.
  • ✓ C.AWS Systems Manager Parameter Store.
  • D.Amazon DynamoDB with encryption at rest.

Why C: AWS Systems Manager Parameter Store is the correct choice because it is designed to store application configuration data like database connection strings and API keys, integrates natively with Amazon ECS for secure parameter retrieval, and supports encryption at rest using AWS KMS. It also provides built-in auditing through AWS CloudTrail, which logs all API calls to the Parameter Store, meeting the auditability requirement.

JA

Written by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.