DVA-C02 Troubleshooting and Optimization Practice Question
Which THREE are valid methods to handle application configuration in AWS? (Choose three.)
⚠ Common exam trap
Test-takers frequently confuse IAM roles with configuration storage, thinking that roles can hold configuration data, when in fact roles only define permissions and cannot store key-value pairs or secrets.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is a valid method for handling application configuration because it securely stores and manages sensitive configuration data such as database credentials, API keys, and other secrets. It supports automatic rotation of secrets, fine-grained access control via IAM policies, and integrates with AWS services like RDS, Redshift, and Lambda. This makes it ideal for managing dynamic configuration values that require high security and lifecycle management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS CloudFormation template parameters
Why it's wrong here
AWS CloudFormation template parameters are primarily used to customize the properties of AWS resources during the deployment of a CloudFormation stack. They define infrastructure configuration at stack creation or update time, not dynamic application runtime configuration that an application would read or modify. Once the stack is deployed, these parameters are static and not designed for direct programmatic access by a running application for configuration changes.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is a dedicated service designed for securely storing, managing, and retrieving sensitive credentials and other secrets, such as database passwords, API keys, and OAuth tokens. Applications can programmatically fetch these secrets at runtime, ensuring that sensitive configuration data is never hardcoded or exposed in plain text within application code or configuration files. It also offers automatic rotation capabilities to enhance security.
- ✗
AWS IAM roles
Why it's wrong here
AWS IAM roles are identity constructs that define a set of permissions for AWS entities, such as EC2 instances or Lambda functions, to access other AWS resources. While crucial for establishing secure access control and authorization, IAM roles do not serve as a mechanism for storing or retrieving application configuration data itself. Their fundamental purpose is to manage who can do what within your AWS environment, not to hold application settings.
- ✓
Lambda environment variables
Why this is correct
Lambda environment variables provide a straightforward and effective method for storing configuration settings specific to a Lambda function's execution environment. These key-value pairs are directly accessible to the function code at runtime, allowing developers to easily modify application behavior without altering the underlying code. They are well-suited for non-sensitive configuration data like API endpoints, feature flags, or logging levels.
- ✓
AWS Systems Manager Parameter Store
Why this is correct
AWS Systems Manager Parameter Store offers a centralized, hierarchical store for configuration data and secrets, supporting both plain text and encrypted parameters. Applications can securely retrieve configuration values at runtime, making it ideal for managing application settings, database connection strings, and other operational data across multiple services and environments. It provides robust versioning, change tracking, and integration with other AWS services for comprehensive configuration management.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,135 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.