DOP-C02 Security and Compliance Practice Question
A DevOps engineer needs to store secrets such as database passwords for a serverless application. Which AWS service is most appropriate?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the most appropriate service because it is specifically designed to manage secrets like database passwords, with automatic rotation, encryption, and fine-grained access control. Option A (DynamoDB) is a database, not a secrets manager. Option B (S3) can store encrypted data but lacks built-in secret rotation and management. Option C (Systems Manager Parameter Store SecureString) can store secrets but does not support automatic rotation, making Secrets Manager the better choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Amazon DynamoDB with encryption
Why it's wrong here
DynamoDB is a NoSQL database, not a purpose-built secrets manager. While you could store secrets in a table and encrypt at rest with KMS, you'd have to build all access control, versioning, rotation, and audit features yourself. It lacks native secret rotation, automatic integration with Lambda for rotation, and fine-grained secret-specific access policies. Storing secrets in a general-purpose database also increases attack surface and operational overhead.
- ✗
Amazon S3 with server-side encryption
Why it's wrong here
S3 is object storage, not a secrets service. Server-side encryption protects data at rest but does not manage key versioning for rotation or provide secret lifecycle management. You would need manual processes to rotate values and update consuming applications. S3 also has broader access management that is not tailored to secret granularity, making it easy to over-expose. There is no built-in integration with RDS or SQL Server for automatic rotation.
- ✗
AWS Systems Manager Parameter Store (SecureString)
Why it's wrong here
SSM Parameter Store SecureString does encrypt values and offers basic access control via IAM, and it integrates with some AWS services. However, it does not provide native automated rotation of secrets or cross-account secret replication capabilities that AWS Secrets Manager offers. It lacks built-in secret rotation templates for RDS/Redshift, and no automatic secret versioning with staged rotation. For a DevOps engineer needing scheduled rotation and a retrieval API specifically for secrets, Secrets Manager is more appropriate.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is a purpose-built service for managing secrets, offering native automatic rotation with Lambda, fine-grained IAM permissions using resource-based policies, and built-in integration with services like RDS, Redshift, and DocumentDB. It supports secret versioning and staged rotation, enforces least-privilege with Secrets Manager resource policies, and provides auditability via CloudTrail. This makes it the ideal choice when the requirement is a managed secrets store with automated lifecycle management.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A DevOps engineer is designing an AWS Lambda function that needs to read secrets from AWS Secrets Manager. What is the most secure way to provide the Lambda function access to the secret?
easy- ✓ A.Assign an IAM execution role to the Lambda function with a policy that allows secretsmanager:GetSecretValue on the specific secret.
- B.Store the secret in AWS Systems Manager Parameter Store and grant the Lambda function access to the parameter.
- C.Encrypt the secret using AWS KMS and pass the encrypted value as an environment variable.
- D.Store the secret in an environment variable in the Lambda function.
Why A: The most secure approach is to give the Lambda function an IAM execution role whose policy grants secretsmanager:GetSecretValue scoped to the specific secret's ARN. Lambda assumes this role at runtime, so no credentials are stored in code or configuration, and the secret value is retrieved dynamically, allowing rotation without redeployment. This follows least privilege and avoids hardcoding secrets.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.