DVA-C02 - Security - Section 2.7

Manage application secrets and configuration securely using AWS Secrets Manager and AWS Systems Manager Parameter Store with rotation and encrypted values.

Store database credentials and API keys in AWS Secrets Manager with automatic rotation, and use AWS Systems Manager Parameter Store for non-secret configuration with optional KMS encryption. Distinguish when each service is the better choice based on rotation needs, cost, and hierarchy requirements.

AWS Secrets ManagerAWS Systems Manager Parameter StoreSecret rotationEncrypted environment variables

Practice question for this objective

Free sampleSecuritymedium

An application already calls Systems Manager Parameter Store with GetParameter to read its plain configuration. A new database credential is stored in AWS Secrets Manager so it can use native rotation. The team wants the application to retrieve that rotated secret through the same Parameter Store GetParameter code path rather than adding the Secrets Manager SDK client. Which retrieval approach achieves this?

  • ACall GetParameter with the name set to the aws reference secretsmanager path followed by the secret name, so Parameter Store returns the Secrets Manager value. Correct
  • BCopy the secret value into a SecureString parameter and schedule a Lambda function to overwrite it whenever Secrets Manager rotates the credential.
  • CCall GetParameter with the secret ARN as the parameter name, because Parameter Store resolves any ARN to its underlying value automatically.
  • DEnable Parameter Store integration on the secret in Secrets Manager so the value is mirrored into a standard parameter of the same name.
Read a Secrets Manager secret through Parameter Store GetParameter using the aws reference secretsmanager name prefix to reuse one SDK call. Parameter Store supports referencing Secrets Manager secrets through the reserved name prefix aws reference secretsmanager, so a single GetParameter call returns the rotated secret value and the application keeps one code path instead of adding a Secrets Manager client.

Why A is correct: Parameter Store can proxy a Secrets Manager secret through the reserved aws reference secretsmanager name prefix, letting the existing GetParameter call return the rotated secret without a separate Secrets Manager client.

Why B is wrong: Duplicating the value into Parameter Store works but adds rotation glue code and a second copy that can drift, which the question asks to avoid by reading the secret directly.

Why C is wrong: Parameter Store does not resolve an arbitrary Secrets Manager ARN passed as a parameter name, so this call fails to return the secret value.

Why D is wrong: There is no toggle that mirrors a secret into a standard parameter, so this setting does not exist and would not expose the value through GetParameter.

See more DVA-C02 practice questions, answers explained.

More in this domain

Back to all Security objectives, or the DVA-C02 cert hub.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.