SCS-C02 Infrastructure Security Practice Question
A company wants to securely store secrets used by an application running on EC2 instances. The secrets include database credentials and API keys. What is the MOST secure and manageable approach?
⚠ Common exam trap
The trap is choosing Parameter Store SecureString because it is also secure and cheaper; however, the question emphasizes 'most secure and manageable,' and Secrets Manager's native rotation and management features make it the better answer.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Secrets Manager and attach an IAM role to the EC2 instance with permission to access the secrets.
AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets such as database credentials and API keys. Attaching an IAM role to the EC2 instance allows the application to retrieve secrets securely without hardcoding credentials, and Secrets Manager supports automatic rotation, auditing via CloudTrail, and fine-grained access control. This is the most secure and manageable approach.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the secrets in the EC2 instance user data and retrieve them from the metadata service.
Why it's wrong here
Storing secrets in EC2 instance user data is insecure because the data is accessible to any process running on the instance via the metadata service. This does not provide fine-grained access control or secret rotation.
- ✗
Embed the secrets in the application code and encrypt the code with a KMS key.
Why it's wrong here
Embedding secrets in application code is insecure even if the code is encrypted with a KMS key, because the decryption key must be made available to the application at runtime. An attacker with access to the running process or instance role can request decryption, and the secret remains exposed in memory dumps, source repositories, and CI/CD logs whenever the app is built or deployed. Additionally, this approach lacks automatic rotation, fine-grained access auditing, and centralized secret management, making it operationally fragile compared to AWS Secrets Manager.
- ✓
Use AWS Secrets Manager and attach an IAM role to the EC2 instance with permission to access the secrets.
Why this is correct
Correct. AWS Secrets Manager integrates with IAM roles for EC2 instances, providing fine-grained access control, automatic secret rotation, and auditing. This is the most secure and manageable approach for storing database credentials and API keys.
- ✗
Use AWS Systems Manager Parameter Store with a SecureString parameter and reference it in the application code.
Why it's wrong here
AWS Systems Manager Parameter Store with SecureString is a secure option, but it lacks automatic rotation and advanced auditing features that AWS Secrets Manager offers, making it less manageable for secrets that require regular rotation.
Go deeper
Related to this question
About these practice questions
One of 1,205 original SCS-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.