ExamPark
Course menuDVA-C03

Exams / DVA-C03 / Secrets and sensitive data / Question 2

DVA-C03 practice question: Secrets and sensitive data (2 of 3)

Security A free question from our original DVA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.

Last verified against current AWS documentation ·How we write our questions

A deployment script on an Amazon EC2 instance reads a SecureString parameter from AWS Systems Manager Parameter Store by running aws ssm get-parameter --name /prod/payments/api-key.

The command succeeds, but the Value in the output is a long unreadable string instead of the key. The instance role already allows ssm:GetParameter and kms:Decrypt on the parameter's KMS key.

What should the developer change?

Choose one answer.

  1. A. Add the --with-decryption option to the command so that Parameter Store decrypts the value before it returns it.
  2. B. Recreate the parameter with the String type so that Parameter Store stops encrypting the value.
  3. C. Add kms:Encrypt on the parameter's KMS key to the instance role so the value can be read back.
  4. D. Read the parameter with get-parameters-by-path --recursive on /prod/payments instead of get-parameter.
Show the answer and explanation

Answer: A

  • A. Right: Correct. SecureString values are returned as ciphertext unless decryption is requested. In the API this is the WithDecryption parameter, and the caller needs kms:Decrypt on the key, which the role already has. Learn more: SecureString parameters (opens in a new tab)
  • B. Wrong: This would expose the key in plain text to everyone who can read the parameter, which weakens the design. The fix is to request decryption when reading, not to remove encryption.
  • C. Wrong: Reading a SecureString needs kms:Decrypt, which the role already has. kms:Encrypt would be needed only when writing the value, and it would not change what a plain read returns. Learn more: SecureString parameters (opens in a new tab)
  • D. Wrong: A path query returns the same ciphertext unless decryption is requested there as well. The option that matters is decryption, not how the parameter is looked up.

Explanation

By default Parameter Store returns a SecureString value as ciphertext. Asking for decryption (--with-decryption in the CLI, WithDecryption in the API) returns the plain value, as long as the caller has kms:Decrypt on the key. Changing the type, adding Encrypt permission or using a path query does not request decryption.

Study

Keep practicing

Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.

Take the free DVA-C03 practice examPractice Secrets and sensitive dataAll Secrets and sensitive data questions

Want more on Secrets and sensitive data? The 5 full-length practice sets have 15 more Secrets and sensitive data questions, 390 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets