ExamPark
Course menuDEA-C01

Exams / DEA-C01 / Credentials and secrets / Question 1

DEA-C01 practice question: Credentials and secrets (1 of 2)

Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A ticket reseller runs an AWS Lambda function that enriches each batch of sale events by calling a partner API. The function reads the partner's API key from AWS Secrets Manager on every invocation, and at peak it runs thousands of times a minute.

Secrets Manager API costs have grown, and some reads are throttled. The key rotates monthly, so the function must pick up a new value within a few minutes, and the team does not want to write its own caching code.

Which solution meets these requirements?

Choose one answer.

  1. A. Copy the API key into an environment variable on the function at each deployment, and stop reading Secrets Manager at run time.
  2. B. Add the AWS Parameters and Secrets Lambda Extension as a layer, and read the key from its local endpoint with a short cache TTL.
  3. C. Request a higher Secrets Manager API quota, and keep calling GetSecretValue on every invocation of the function.
  4. D. Move the key into a DynamoDB table, and read it with a strongly consistent GetItem call on every invocation of the function.
Show the answer and explanation

Answer: B

  • A. Wrong: The function would keep the old key after each rotation until someone redeploys it. The key would also be visible to anyone who can view the function's configuration.
  • B. Right: Correct. The extension caches the secret inside the execution environment, so most invocations read it locally instead of calling Secrets Manager. A cache TTL of a few minutes picks up the rotated key soon after rotation, with no caching code to write. Learn more: Using AWS Secrets Manager secrets in AWS Lambda functions (opens in a new tab)
  • C. Wrong: A higher quota may reduce throttling, but every invocation still makes a billable API call. The cost the team wants to cut keeps growing with traffic.
  • D. Wrong: Every invocation would still make a remote call, now billed as DynamoDB reads. The key would also lose Secrets Manager's rotation, so the monthly change would become manual work.

Explanation

Reading a secret on every invocation adds API cost and can be throttled at high volume. The AWS Parameters and Secrets Lambda Extension caches the value in the execution environment for a configurable TTL, so the function makes few calls and still sees a rotated key within minutes. Environment variables, higher quotas and a DynamoDB copy either miss rotations or keep the per-call cost.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DEA-C01 practice examPractice Credentials and secretsAll Credentials and secrets questions

Want more on Credentials and secrets? The 5 full-length practice sets have 9 more Credentials and secrets questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets