CLF-C02 Security and Compliance Practice Question
A company runs a web application on Amazon EC2 instances behind an Application Load Balancer. The application connects to an Amazon RDS for MySQL database. The database password is currently hardcoded in the application configuration file, and the security team is concerned about the risk of exposure. The company wants to remove the hardcoded credential and instead have the application retrieve the database password securely at runtime. Additionally, the security team requires that the password be automatically rotated every 90 days without any manual intervention or custom scripting. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
It's easy for candidates to confuse AWS Systems Manager Parameter Store (SecureString) with Secrets Manager, but Parameter Store lacks native automatic rotation, which is the critical requirement in this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials (including RDS for MySQL) without custom code. It supports native, automatic rotation of secrets every 90 days via a built-in Lambda rotation function, meeting the security team's requirement for zero manual intervention. Unlike Parameter Store, Secrets Manager provides automatic rotation out of the box, which is the key differentiator here.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Systems Manager Parameter Store (SecureString parameters)
Why it's wrong here
While Parameter Store can securely store secrets as SecureString parameters, it does not natively support automatic rotation. A custom AWS Lambda function must be created to rotate the secret, which does not meet the requirement for a fully managed, no-custom-scripting solution.
When this WOULD be correct
A company needs to store a database password securely and retrieve it at runtime, but does not require automatic rotation. The security team is willing to manually rotate the password or use a custom script. In that case, Parameter Store with SecureString parameters would be a cost-effective and appropriate choice.
- ✗
AWS Key Management Service (AWS KMS)
Why it's wrong here
AWS KMS is a key management service that creates and controls encryption keys, not credentials. While KMS can encrypt a database password at rest, it has no capability to store the password itself, retrieve it on demand, or rotate it. You would still need a separate storage service for the encrypted password and a custom mechanism to rotate it, so KMS alone cannot satisfy the requirement.
When this WOULD be correct
A company needs to encrypt data at rest in an S3 bucket using a customer-managed key, with automatic annual key rotation. AWS KMS would be the correct service to create and manage the CMK with automatic rotation enabled.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is a fully managed service built specifically to store, retrieve, and rotate secrets such as database credentials. It provides native, automated rotation for Amazon RDS databases without requiring custom code or additional infrastructure — you simply attach the required IAM role and choose a rotation interval. Because Secrets Manager natively meets both the secure storage and automatic rotation requirements, it is the best choice for this use case.
- ✗
AWS Identity and Access Management (IAM) roles for Amazon EC2
Why it's wrong here
IAM roles for EC2 provide the instance with temporary AWS credentials to make API calls to AWS services, but these are not database credentials. RDS database passwords are managed by the RDS engine and are completely separate from IAM authentication. Even when IAM database authentication is used, IAM does not rotate or manage a stored password; it only governs the permission to connect, which does not meet the stated requirement to automatically rotate a database password.
When this WOULD be correct
A question where the requirement is to grant an EC2 instance permissions to access other AWS services (e.g., S3, DynamoDB) without storing credentials on the instance, and no need for secret rotation or storage.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Secrets ManagerCorrect answer▾
Why this is correct
AWS Secrets Manager is a fully managed service built specifically to store, retrieve, and rotate secrets such as database credentials. It provides native, automated rotation for Amazon RDS databases without requiring custom code or additional infrastructure — you simply attach the required IAM role and choose a rotation interval. Because Secrets Manager natively meets both the secure storage and automatic rotation requirements, it is the best choice for this use case.
✗AWS Systems Manager Parameter Store (SecureString parameters)Wrong answer — click to see why▾
Why this is wrong here
AWS Systems Manager Parameter Store (SecureString) does not support automatic rotation of secrets. The question explicitly requires automatic rotation every 90 days without manual intervention or custom scripting, which Parameter Store cannot provide.
★ When this WOULD be the correct answer
A company needs to store a database password securely and retrieve it at runtime, but does not require automatic rotation. The security team is willing to manually rotate the password or use a custom script. In that case, Parameter Store with SecureString parameters would be a cost-effective and appropriate choice.
Why candidates choose this
Candidates may confuse Parameter Store's SecureString parameters with Secrets Manager, as both can store secrets securely. They might overlook the automatic rotation requirement, assuming Parameter Store can handle rotation via its integration with other services, but it lacks built-in rotation capabilities.
✗AWS Key Management Service (AWS KMS)Wrong answer — click to see why▾
Why this is wrong here
AWS KMS is a key management service for encryption keys, not a secrets storage service. It does not natively store or rotate database passwords; it only encrypts data. The requirement to retrieve and automatically rotate secrets is outside KMS's scope.
★ When this WOULD be the correct answer
A company needs to encrypt data at rest in an S3 bucket using a customer-managed key, with automatic annual key rotation. AWS KMS would be the correct service to create and manage the CMK with automatic rotation enabled.
Why candidates choose this
Candidates may confuse KMS's encryption capabilities with secrets management, thinking that storing an encrypted password in the application config and decrypting it with KMS satisfies the requirement, but KMS lacks built-in rotation and retrieval APIs for secrets.
✗AWS Identity and Access Management (IAM) roles for Amazon EC2Wrong answer — click to see why▾
Why this is wrong here
IAM roles grant permissions to EC2 instances but cannot store or retrieve secrets like database passwords; they are used for AWS API access, not for secure secret retrieval at runtime.
★ When this WOULD be the correct answer
A question where the requirement is to grant an EC2 instance permissions to access other AWS services (e.g., S3, DynamoDB) without storing credentials on the instance, and no need for secret rotation or storage.
Why candidates choose this
Candidates may confuse IAM roles with secret management, thinking that an IAM role can somehow provide the database password, or they may overestimate the scope of IAM roles in handling application secrets.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.