DVA-C02 Security Practice Question
A developer is building an application that needs to read a secret API key from AWS Secrets Manager. The application runs on an EC2 instance that is part of an Auto Scaling group. The developer wants to ensure that only this application can retrieve the secret. Which set of steps should the developer take?
⚠ Common exam trap
Candidates often think storing secrets in user data or configuration files is acceptable for simplicity, but the exam emphasizes secure, managed solutions like IAM roles and Secrets Manager to avoid hardcoding credentials and to enable automatic rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the secret in Secrets Manager, attach an IAM role to the EC2 instance that grants permission to read the secret, and configure the application to retrieve the secret using the AWS SDK
It follows the principle of least privilege and uses IAM roles, which are the secure and recommended way to grant EC2 instances permissions to access AWS Secrets Manager. By attaching an IAM role to the EC2 instance, the application can securely retrieve the secret using the AWS SDK without embedding long-term credentials in code or configuration files. This ensures that only instances with that role can read the secret, and the credentials are automatically rotated by AWS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the secret in Secrets Manager, create an IAM user with a policy to read the secret, and embed the user's credentials in the application code
Why it's wrong here
This approach is fundamentally insecure because embedding IAM user credentials directly into application code creates a significant vulnerability. These static, long-term credentials can easily be exposed through source code repositories, build artifacts, or even memory dumps, making them a prime target for attackers. Unlike temporary credentials provided by IAM roles, these require manual rotation and revocation, increasing operational overhead and the window of exposure if compromised.
- ✓
Store the secret in Secrets Manager, attach an IAM role to the EC2 instance that grants permission to read the secret, and configure the application to retrieve the secret using the AWS SDK
Why this is correct
This is the recommended secure pattern for accessing AWS services from EC2 instances. By attaching an IAM role to the EC2 instance, the application running on it can assume the role's permissions through the instance profile, obtaining temporary, automatically rotated credentials. The AWS SDK then transparently handles the retrieval and refresh of these credentials, eliminating the need to store any static credentials on the instance or in code, thereby adhering to the principle of least privilege and enhancing security posture.
- ✗
Store the secret as an environment variable in the EC2 user data
Why it's wrong here
Storing secrets in EC2 user data is highly insecure because user data is publicly retrievable via the EC2 console, API calls (e.g., describe-instances), and often logged in system logs, making the secret easily discoverable. Furthermore, environment variables themselves are not a secure storage mechanism for sensitive data, as they can be inspected by other processes on the instance, inherited by child processes, or exposed through debugging tools, creating multiple attack vectors.
- ✗
Store the secret in a configuration file on the instance and restrict file permissions
Why it's wrong here
Storing secrets directly in a configuration file on the instance, even with restrictive file permissions, is a less secure and less scalable approach. While permissions offer some protection, a compromised instance or misconfigured backup could still expose the secret. This method also introduces significant operational overhead for secure distribution, versioning, and manual rotation of secrets across multiple instances, lacking the centralized management and automatic rotation capabilities offered by services like AWS Secrets Manager.
Go deeper
Related to this question
About these practice questions
Courseiva writes every DVA-C02 question from scratch — 724 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.