CCSP Cloud Application Security Practice Question
An organization deploys a serverless application using AWS Lambda functions that access an RDS database. Which practice best ensures that the database credentials are protected?
⚠ Common exam trap
Many candidates confuse 'temporary tokens' (Option D) with a secure credential storage method, but the CCSP exam expects you to recognize that managing the initial secret (the token's root of trust) is still required, and Parameter Store with KMS is the definitive best practice for protecting static credentials in serverless architectures.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Systems Manager Parameter Store with KMS encryption and IAM roles
AWS Systems Manager Parameter Store, combined with AWS KMS for encryption and IAM roles for access control, provides a secure, auditable, and managed way to store and retrieve database credentials. This approach avoids embedding secrets in code or environment variables, and it integrates natively with AWS Lambda via the IAM execution role, ensuring that only authorized functions can decrypt and access the credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store credentials in the function code
Why it's wrong here
Embedding credentials in function code exposes them to anyone with read access to the deployment package or repository, and rotation requires redeployment. This is tempting for quick prototypes, but production Lambda functions should retrieve secrets at runtime from AWS Secrets Manager or Parameter Store.
- ✓
Use AWS Systems Manager Parameter Store with KMS encryption and IAM roles
Why this is correct
Storing credentials in Systems Manager Parameter Store with KMS encryption keeps secrets encrypted at rest, while IAM roles let Lambda retrieve them without embedded static keys. This satisfies the scenario's constraint of protecting database credentials in a serverless environment, since no long-lived secrets reside in function code or environment variables.
- ✗
Hardcode credentials in environment variables
Why it's wrong here
Lambda environment variables are visible in plaintext to anyone with GetFunctionConfiguration permission and appear in the console, so hardcoding secrets there leaks them. This is tempting because it avoids code changes, but Secrets Manager or Parameter Store with encryption is the protected approach.
- ✗
Use database temporary tokens generated on the fly
Why it's wrong here
Temporary tokens still require a secrets source to mint them, so the credential-storage problem persists unless IAM database authentication is used. The tempting appeal is rotation without redeployment, which suits long-lived EC2 services rather than Lambda's per-invocation execution model.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 934 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.