nerdexam
Amazon

DVA-C02 · Question #338

A developer is building a containerized application on AWS. The application communicates with a third-party service by using API keys. The developer needs a secure way to store the API keys and pass…

The correct answer is A. Store the API keys as a SecureString parameter in AWS Systems Manager Parameter Store. E. Store the API keys as a SecretString parameter in AWS Secrets Manager. Grant the application. API keys for containerized applications should be stored in a dedicated secrets service that encrypts values at rest and integrates with IAM, not embedded in code or templates.

Submitted by andres_qro· Mar 5, 2026Security

Question

A developer is building a containerized application on AWS. The application communicates with a third-party service by using API keys. The developer needs a secure way to store the API keys and pass the API keys to the containerized application. Which solutions will meet these requirements? (Choose two.)

Options

  • AStore the API keys as a SecureString parameter in AWS Systems Manager Parameter Store.
  • BStore the API keys in AWS CloudFormation templates by using base64 encoding. Pass the API
  • CAdd a new AWS CloudFormation parameter to the CloudFormation template. Pass the API keys
  • DEmbed the API keys in the application. Build the container image on-premises. Upload the
  • EStore the API keys as a SecretString parameter in AWS Secrets Manager. Grant the application

How the community answered

(26 responses)
  • A
    81% (21)
  • B
    8% (2)
  • C
    8% (2)
  • D
    4% (1)

Why each option

API keys for containerized applications should be stored in a dedicated secrets service that encrypts values at rest and integrates with IAM, not embedded in code or templates.

AStore the API keys as a SecureString parameter in AWS Systems Manager Parameter Store.Correct

AWS Systems Manager Parameter Store with the SecureString type encrypts values using AWS KMS and allows the container to retrieve them at runtime via the SSM API, keeping keys out of the image and source code.

BStore the API keys in AWS CloudFormation templates by using base64 encoding. Pass the API

Base64 encoding is not encryption; anyone with access to the CloudFormation template can trivially decode the keys, providing no real security.

CAdd a new AWS CloudFormation parameter to the CloudFormation template. Pass the API keys

A plain CloudFormation parameter is stored in plaintext in the stack configuration and is not encrypted at rest, making it unsuitable for sensitive credentials.

DEmbed the API keys in the application. Build the container image on-premises. Upload the

Embedding API keys directly in a container image bakes secrets into the image layer, which can be extracted by anyone with pull access to the image registry.

EStore the API keys as a SecretString parameter in AWS Secrets Manager. Grant the applicationCorrect

AWS Secrets Manager stores secrets as encrypted SecretString values, supports fine-grained IAM access policies, and provides native secret rotation, making it a fully managed and secure solution for passing credentials to containers.

Concept tested: Secure secret storage with Parameter Store and Secrets Manager

Source: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DVA-C02 Practice