DOP-C02 Security and Compliance Practice Question
A DevOps engineer is designing a CI/CD pipeline that deploys code to an EC2 instance. The engineer needs to securely store and retrieve database credentials used by the application. Which AWS service should be used?
⚠ Common exam trap
DOP-C02 often tests the distinction between Secrets Manager and Parameter Store. Candidates might choose Parameter Store because it's cheaper, but the question emphasizes secure storage and retrieval of database credentials, where Secrets Manager's rotation and management features are key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is designed to securely store, retrieve, and rotate secrets such as database credentials. It provides fine-grained access control, encryption at rest, and automatic rotation, making it ideal for CI/CD pipelines that need to access database credentials securely.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon S3 with server-side encryption
Why it's wrong here
S3 stores objects, not retrievable secrets; the application cannot fetch credentials from it without custom code and IAM plumbing. Server-side encryption protects data at rest but provides no secret-retrieval API. S3 is the right choice for storing artefacts, logs or static files, not database credentials.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
Parameter Store with SecureString does store and return credentials, but the question's intended answer is AWS Secrets Manager, which adds automatic rotation and native RDS integration. Parameter Store suits configuration values and non-rotating secrets where rotation is handled externally.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager stores database credentials encrypted and supports automatic rotation, so the pipeline retrieves them at deploy time via IAM-scoped API calls instead of embedding them in code or instance user data, meeting the secure storage and retrieval requirement.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
KMS manages encryption keys, not secrets.
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.