Amazon Web Services DVA-C02 Exam With Confidence Using Practice Dumps

The most secure solution is A because AWS Secrets Manager is purpose-built for storing, retrieving, and managing secrets such as database credentials, API keys, and tokens. In AWS guidance, Secrets Manager is recommended when applications need secure secret storage with controlled access, encryption, and integration with runtime retrieval patterns. By storing the credentials as a secret and passing only the secret ARN through an environment variable, the Lambda function avoids exposing the actual username and password in plaintext configuration.

The AWS Parameters and Secrets Lambda Extension is specifically designed to let Lambda functions retrieve secrets securely at invocation time. This reduces the risk of accidental exposure in code, deployment artifacts, or function configuration. Secrets Manager also supports automatic rotation , which is a major security advantage for database credentials and is one of the main reasons AWS recommends it over hardcoded or manually managed values.

Option B is incorrect because base64 is only encoding, not encryption, and embedding credentials in source code is insecure. Option C is less appropriate because a string type parameter in Systems Manager Parameter Store is not the secure choice for sensitive credentials; secure storage there would require SecureString , but even then Secrets Manager is the stronger AWS-recommended service for database secrets. Option D only masks values in CloudFormation outputs and logs with NoEcho ; it does not provide secure runtime secret retrieval or secret lifecycle management.

Therefore, A is the best and most secure answer according to AWS security best practices for Lambda applications handling database credentials.

This workload is overwhelmingly read-heavy and repeatedly queries the same relatively static reference data (postal codes mapped to coordinates). The best way to reduce latency and offload Amazon RDS is to introduce an application-side cache using a lazy loading (cache-aside) pattern and choose a TTL that reflects how often the underlying data changes.

With lazy loading , the application first checks the cache for the postal code. If the value is present (a cache hit), the application returns the coordinates immediately with low latency and without querying the database. If the value is absent (a cache miss), the application reads from RDS, returns the result, and then populates the cache for subsequent requests. This pattern is operationally simple and widely used because the application controls what is cached and when.

A large TTL is appropriate here because postal-code-to-coordinate mappings typically do not change frequently. A longer TTL maximizes cache hit ratio, which is critical because each postal code is requested thousands of times per day. High cache hit rates reduce database read load, decrease query contention, and substantially improve response times. In contrast, a small TTL would cause frequent expirations and repeated database lookups, reducing the performance benefit and increasing database load.

Write-through and write-behind caching (options C and B) are designed to coordinate caching with writes . They are useful when write consistency and write performance are central concerns. Here, writes are rare; the performance issue is repeated reads. Write-behind can also introduce consistency delays, which is unnecessary for this scenario.

Therefore, the best change is D : implement a lazy loading (cache-aside) caching strategy with a large TTL to keep hot, rarely changing postal code lookups in cache and dramatically reduce read latency and database load.

Comprehensive Detailed Step by Step Explanation with All AWS Developer References:

When you need to provide an AWS Lambda function access to private resources in a VPC, the most common and straightforward approach is to attach the Lambda function to a VPC via private subnets. Once the Lambda function is associated with the VPC, you need to configure appropriate security groups to control the access to the private resources.

Lambda with VPC Access: Lambda functions can be attached to private subnets in a VPC, allowing them to access resources like RDS, EC2, or internal services within that VPC.

Security Groups: A security group acts as a virtual firewall for the Lambda function, ensuring that it can access only the necessary resources and ports in the VPC.

Alternatives:

Option B involves routing traffic through a VPN, which adds unnecessary complexity and operational overhead compared to simply attaching the Lambda to the VPC.

Option C requires configuring a VPC endpoint and a NAT gateway, which can be complex and costly.

Option D refers to AWS PrivateLink, which is used to access services over private connections, but it ' s unnecessary in this scenario unless you need a cross-VPC connection.

Lambda functions in a VPC