Encryption, Secrets and Data Protection
This topic covers KMS, encryption at rest and in transit, Secrets Manager, Parameter Store, key policies, rotation, and secure application configuration.
How to study for AWS Developer Associate
Treat each question as an application delivery scenario: identify the service integration, permission boundary, deployment path, and operational signal before choosing an answer.
Core concepts
Concept 1
Encryption, Secrets and Data Protection questions test AWS developer decisions in code, deployment, security, and operations.
Exam cue: Identify the runtime, integration point, data store, permission boundary, and deployment path in the scenario.
Concept 2
The strongest answer maps the application requirement to the managed AWS service feature that reduces custom code and operational risk.
Exam cue: Choose the AWS service behavior that satisfies the requirement with secure defaults and measurable failure handling.
Concept 3
Eliminate options that expose credentials, bypass least privilege, ignore throttling, or trade observability for convenience.
Exam cue: Prefer managed retries, idempotency, IAM roles, encryption, tracing, and staged release controls when the prompt calls for them.
Risk pitfalls and guardrails
Hard-coding credentials, secrets, or endpoints when AWS provides role-based or managed configuration options.
Guardrail: Avoid answers that hard-code secrets, skip IAM roles, ignore retry behavior, hide failures, or deploy unversioned code directly to production.
Choosing a compute or messaging pattern without considering retry behavior, ordering, idempotency, or concurrency.
Guardrail: Avoid answers that hard-code secrets, skip IAM roles, ignore retry behavior, hide failures, or deploy unversioned code directly to production.
Treating logs, metrics, and traces as afterthoughts instead of exam-tested troubleshooting evidence.
Guardrail: Avoid answers that hard-code secrets, skip IAM roles, ignore retry behavior, hide failures, or deploy unversioned code directly to production.
Memory anchors
KMS Key
An AWS KMS key protects data keys and integrates with many AWS services for encryption at rest.
Envelope Encryption
Envelope encryption encrypts data with a data key and protects that data key with a KMS key.
Secrets Manager
AWS Secrets Manager stores secrets and can rotate supported credentials automatically.
Parameter Store
Systems Manager Parameter Store stores configuration values and secure strings for applications.
TLS
TLS protects data in transit between clients, APIs, services, and backend endpoints.
S3 SSE-KMS
S3 SSE-KMS encrypts objects at rest using KMS keys and supports key-level access control.
DynamoDB Encryption
DynamoDB encrypts table data at rest and can use AWS owned, AWS managed, or customer managed keys.
Lambda Environment Encryption
Lambda encrypts environment variables at rest and can use customer managed KMS keys.
Key Policy
A key policy controls who can administer and use a KMS key.
Secret Rotation
Secret rotation reduces the risk of long-lived credentials in applications.
Checkpoint rule
Do the check-up only after you can summarize each concept in one sentence and identify one dangerous pitfall from memory.
Knowledge Check (after reading)
Short check-up to confirm understanding of this module.
Check-up Questions
An application must encrypt large files locally before uploading them to S3. It should use AWS KMS without sending entire files to the KMS API. Which pattern is appropriate?
A service calls GenerateDataKey and receives a plaintext data key and an encrypted data key. What should it do with the plaintext key after encrypting the data?
Answer all questions to submit.
Next step personalized recommendations
Continue learning
Move forward only after this module is stable.
What is Pass Harbor?
Completely free exam prep for 317 U.S. exams.
- Practice questions
- Flashcards
- Study guides
- Mock exams
- No registration
- No paywall
- Start instantly
“No more expensive exam prep. Quality study tools should be accessible to everyone.”