mediumMultiple SelectObjective-mapped
CCSP Practice Question: A development team builds a serverless…
A development team builds a serverless application using AWS Lambda. The security team wants to prevent hardcoded credentials. Which TWO methods should they enforce for secure secrets management?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Assign an IAM role to the Lambda function and retrieve temporary credentials via the AWS SDK
Using cloud-native secret managers and IAM roles are secure ways to manage secrets without hardcoding. AWS Systems Manager Parameter Store is a secret manager; Lambda execution roles eliminate the need for embedded credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store secrets in environment variables in plain text
Why it's wrong here
Plaintext env vars are not secure; they can be exposed.
- ✓
Assign an IAM role to the Lambda function and retrieve temporary credentials via the AWS SDK
Why this is correct
Correct. IAM roles provide temporary credentials without hardcoding.
- ✗
Embed secrets directly in the Lambda function code but encrypt the code
Why it's wrong here
Embedding secrets is insecure even if code is encrypted; secrets can be exposed at runtime.
- ✗
Use a third-party secrets manager with a hardcoded API key in the code
Why it's wrong here
Hardcoding the API key to the secrets manager defeats the purpose.
- ✓
Use AWS Systems Manager Parameter Store with KMS encryption
Why this is correct
Correct. Parameter Store with encryption provides secure secret storage.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This CCSP question is part of Courseiva's 964-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.