Exams / DVA-C02 / Secrets and sensitive data / Question 2
DVA-C02 practice question: Secrets and sensitive data (2 of 3)
Security A free question from our original DVA-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A Lambda function reads an API key stored as a SecureString parameter in AWS Systems Manager Parameter Store. The call succeeds, but the value the function receives is a long encrypted string instead of the API key. What should the developer change?
Choose one answer.
- AA. Change the parameter type from SecureString to String so it is returned in plain text.
- BB. Add kms:Encrypt on the parameter's KMS key to the function's execution role.
- CC. Set WithDecryption to true in the GetParameter request.
- DD. Move the parameter to a hierarchy path such as /prod/api-key.
Show the answer and explanation
Answer: C
- A. Wrong: This would store the secret unencrypted, which defeats the purpose of using SecureString.
- B. Wrong: Encrypt is needed to write the value, not to read it, and a permissions problem would cause an error rather than ciphertext.
- C. Right: Correct. Parameter Store then decrypts the value with KMS before returning it, provided the role is allowed kms:Decrypt.
- D. Wrong: Paths organise parameters and help scope permissions. They do not control decryption.
Explanation
SecureString parameters are encrypted with an AWS KMS key. Reading one returns ciphertext unless the request sets WithDecryption to true, and the caller then needs kms:Decrypt on the key as well as ssm:GetParameter on the parameter.
Study
Keep practising
Answer questions with a score at the end, or practise just this topic with the explanation after each one. No sign-up needed.