Question 259 of 724
DVA-C02 Security Practice Question
Network Topology
Refer to the exhibit. A developer ran this CLI command and received the output shown. The application is retrieving the secret but getting an authentication error from the database. What is the MOST likely issue?
⚠ Common exam trap
Test-takers frequently assume any retrieval error is due to an incorrect secret ID or missing label, but the question explicitly states the secret was retrieved successfully, shifting the issue to how the application processes the retrieved value.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The application is not correctly parsing the JSON SecretString.
The CLI command successfully retrieved the secret, as shown by the output containing the secret value. The application, however, is failing with an authentication error from the database. This indicates that the secret was retrieved but the application is likely misinterpreting the JSON structure of the SecretString. If the secret is stored as a JSON object (e.g., containing username and password fields), the application must parse the JSON and extract the correct field (e.g., 'password'). If it treats the entire JSON string as the password, it will pass an invalid credential to the database, causing an authentication error.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The secret is not marked as AWSCURRENT.
Why it's wrong here
The `AWSCURRENT` label indicates the current version of the secret. The command output explicitly shows `VersionStages: ["AWSCURRENT"]`, confirming that the retrieved secret value is indeed the current one. Therefore, the issue is not that the secret lacks the `AWSCURRENT` stage, but rather how the application handles the *content* of that current secret.
- ✓
The application is not correctly parsing the JSON SecretString.
Why this is correct
AWS Secrets Manager typically stores credentials as a JSON string within the `SecretString` field, containing key-value pairs like `{"username":"user", "password":"p@ss"}`. Applications must correctly parse this JSON to extract individual components, such as the password. If the application fails to properly deserialize the JSON or handle special characters within the password value, it might attempt to use the entire unparsed string or an incorrect substring, leading to authentication failures.
- ✗
The CLI command should have used the --secret-string parameter.
Why it's wrong here
The `get-secret-value` command is designed solely for retrieving a secret's value, not for setting it. The `--secret-string` parameter is specifically used with commands like `create-secret` or `update-secret` to provide the actual secret content to be stored in Secrets Manager. Using `--secret-string` with `get-secret-value` would result in a CLI error, indicating an invalid parameter for the operation.
- ✗
The secret ID is incorrect.
Why it's wrong here
If the `secret-id` provided in the AWS CLI command were genuinely incorrect or referred to a non-existent secret, the `aws secretsmanager get-secret-value` command would have failed. Such a failure would typically manifest as an error message, such as `ResourceNotFoundException`. Since the command successfully executed and returned a `SecretString`, the specified secret ID was valid and correctly identified the target secret.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 24, 2026
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.