ExamPark
Course menuDVA-C03

Exams / DVA-C03 / Secrets and sensitive data / Question 1

DVA-C03 practice question: Secrets and sensitive data (1 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A Lambda function connects to an Amazon RDS for PostgreSQL database using a password that is hard-coded in its source.

The security team wants the password out of the code, rotated automatically every 30 days, and picked up by the function without a redeployment. The team wants the LEAST operational overhead.

What should the developer do?

Choose one answer.

  1. A. Keep the password in a Systems Manager Parameter Store SecureString and rotate it with a scheduled Lambda function that the team writes.
  2. B. Put the password in a KMS-encrypted Lambda environment variable and have the CI/CD pipeline change it every month.
  3. C. Store the password in AWS Secrets Manager with a 30-day rotation schedule, and have the function call GetSecretValue at run time.
  4. D. Keep the password in an encrypted S3 object that a scheduled job replaces every 30 days, read by the function on each call.
Show the answer and explanation

Answer: C

  • A. Wrong: Parameter Store has no built-in rotation, so the team would write, test and operate the rotation function itself. It would also need to change the database password in step. Secrets Manager provides this rotation as a feature. Learn more: Rotating secrets (opens in a new tab)
  • B. Wrong: Environment variables are fixed when a version is configured, so each change means a new configuration and a pipeline job to run. This is more effort and not automatic rotation.
  • C. Right: Correct. Secrets Manager supports automatic rotation on a schedule and updates both the secret and the database. Because the function reads the secret when it runs, it gets the new password without a redeployment. Learn more: What is AWS Secrets Manager? (opens in a new tab)
  • D. Wrong: S3 can hold an encrypted file, but nothing changes the database password in step with the file. The team would build the schedule, the job and the coordination with the database.

Explanation

Secrets Manager rotates credentials on a schedule, updating both the secret and the database, and applications that fetch the secret at run time pick up each new value without a redeployment. Parameter Store, environment variables and S3 files all leave the team building and running the rotation.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice Secrets and sensitive dataAll Secrets and sensitive data questions

Want more on Secrets and sensitive data? The 5 full-length practice sets have 15 more Secrets and sensitive data questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets