DVA-C02 Development with AWS Services Practice Question
A developer is building an AWS Lambda function that needs to retrieve a database password securely. The password is stored in AWS Secrets Manager and is rotated every 30 days. The function must minimize the number of API calls to Secrets Manager. Which approach should the developer use?
⚠ Common exam trap
It's easy for candidates to assume 'minimize API calls' means never calling Secrets Manager again, but the correct approach allows a single call per cold start with a fallback refresh on failure, not zero calls forever.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Retrieve the secret from Secrets Manager once outside the handler function, cache it in a global variable, and refresh the cache if the secret fails.
It retrieves the secret once during the Lambda cold start (outside the handler), caches it in a global variable, and only refreshes the cache if the secret fails (e.g., due to rotation). This minimizes API calls to Secrets Manager while still handling secret rotation gracefully, as the cached secret remains valid until a failure occurs.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the database password as an encrypted environment variable in the Lambda function.
Why it's wrong here
Storing a database password as an encrypted environment variable in a Lambda function is generally discouraged for dynamic credentials. While AWS encrypts these variables at rest using KMS, they lack native rotation capabilities, meaning any password change would necessitate redeploying the Lambda function. This approach introduces significant operational overhead and increases the risk of using stale or compromised credentials over time, failing to meet best practices for secret lifecycle management.
- ✗
Call Secrets Manager on every invocation to get the latest secret.
Why it's wrong here
Calling Secrets Manager on every invocation contradicts the requirement to minimise API calls, as each invocation incurs a fresh `GetSecretValue` request, increasing latency and cost. This approach is tempting because it guarantees the function always uses the most recent secret after rotation, and would be correct in a scenario where the secret is rotated unpredictably and caching the secret for any duration is unacceptable.
- ✓
Retrieve the secret from Secrets Manager once outside the handler function, cache it in a global variable, and refresh the cache if the secret fails.
Why this is correct
Retrieving the secret from Secrets Manager once outside the handler function and caching it in a global variable is an optimal pattern for Lambda. This approach leverages the execution environment's persistence, significantly reducing latency and cost by minimizing `GetSecretValue` API calls across warm invocations. If the secret is rotated, the cached value will eventually fail authentication, triggering a refresh from Secrets Manager to retrieve the latest version, ensuring both efficiency and up-to-date security.
- ✗
Use AWS Systems Manager Parameter Store SecureString instead of Secrets Manager.
Why it's wrong here
Using AWS Systems Manager Parameter Store SecureString instead of Secrets Manager for database passwords, especially when rotation is a requirement, is not ideal. While SecureString provides encryption for sensitive data, it does not offer the native, automated secret rotation capabilities that AWS Secrets Manager provides out-of-the-box. Secrets Manager is specifically designed for managing database credentials and other secrets that require lifecycle management, including automatic rotation, making it the more appropriate service for this use case.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.