Exams / DVA-C02 / Secrets and sensitive data / Question 1
DVA-C02 practice question: Secrets and sensitive data (1 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
An application on AWS Lambda connects to an Amazon RDS database. The password is currently hard-coded in the source. The security team wants the password removed from the code and changed automatically on a schedule, without redeploying the application. What should the developer use?
Choose one answer.
- AA. A Lambda environment variable containing the password, updated by hand each month.
- BB. A Systems Manager Parameter Store String parameter that the function reads at start-up.
- CC. An encrypted file in an S3 bucket that the function downloads on every invocation.
- DD. AWS Secrets Manager with rotation turned on, with the function retrieving the secret at runtime.
Show the answer and explanation
Answer: D
- A. Wrong: This removes the password from source code, but nothing changes it automatically, and each change means updating the function.
- B. Wrong: A plain String parameter is not encrypted, and Parameter Store does not rotate database passwords for you.
- C. Wrong: You would have to build the rotation and keep the file in sync with the database yourself.
- D. Right: Correct. Secrets Manager rotates the secret on a schedule, updating the database too, and the app always reads the current value.
Explanation
Secrets Manager stores secrets such as database credentials and rotates them on a schedule, either through managed rotation or a rotation Lambda function. Because applications fetch the secret at runtime, rotation needs no code change or redeployment.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.