CLF-C02 Security and Compliance Practice Question
A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS MySQL database. The application requires database credentials to authenticate. The security team wants to eliminate the practice of storing database credentials in the application code or configuration files. Additionally, the team needs a managed service that can automatically rotate the database credentials on a regular schedule without any manual intervention. Which AWS service should the security team use to store and manage these database credentials?
⚠ Common exam trap
Many candidates confuse AWS Systems Manager Parameter Store with Secrets Manager because both can store secrets, but Parameter Store lacks native automatic rotation, which is the key requirement in this question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is a managed service specifically designed to store, manage, and automatically rotate database credentials (such as those for Amazon RDS MySQL) on a scheduled basis without manual intervention. It natively integrates with Amazon RDS to rotate credentials, eliminating the need to embed secrets in application code or configuration files, which directly addresses the security team's requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is the correct choice because it is a purpose-built service for securely storing and managing secrets such as database credentials. It natively supports automatic rotation of secrets for Amazon RDS, allowing you to configure a rotation schedule without building custom automation. The service also integrates with AWS Lambda to rotate credentials for other services, and it enforces fine-grained access control via IAM policies, ensuring that only authorized EC2 instances can retrieve the current credentials.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store can store secure string parameters, but it does not offer native automatic rotation of secrets. You would need additional custom automation to rotate credentials, which does not meet the requirement for a managed automatic rotation service.
When this WOULD be correct
A company needs to store configuration data (e.g., database URLs, application settings) that does not require automatic rotation, and they want a simple, low-cost solution integrated with AWS Systems Manager for operational management.
- ✗
AWS Identity and Access Management (IAM) roles
Why it's wrong here
IAM roles are used to grant permissions to AWS resources and services (e.g., an EC2 instance assuming a role to access S3). They are not designed to store or rotate database credentials for an application connecting to a database.
When this WOULD be correct
A correct scenario would be: 'A company runs an application on EC2 that needs to access an S3 bucket. The security team wants to avoid storing AWS access keys on the EC2 instance. Which AWS feature should they use?' In that case, an IAM role attached to the EC2 instance would provide temporary credentials for API access.
- ✗
AWS Key Management Service (AWS KMS)
Why it's wrong here
AWS KMS is a service for creating and managing customer master keys (CMKs) used to encrypt and decrypt data. It does not have a feature to store secrets like database usernames or passwords, nor does it provide any automatic rotation of application credentials. While KMS can encrypt the secrets that are stored elsewhere (e.g., in Secrets Manager), it is not a secret store itself, so it cannot meet the requirement for storing and rotating database credentials.
When this WOULD be correct
A company needs to encrypt data at rest in an S3 bucket using a customer-managed key and must be able to rotate the key annually. AWS KMS would be the correct service to create, manage, and rotate the encryption keys.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Secrets ManagerCorrect answer▾
Why this is correct
AWS Secrets Manager is the correct choice because it is a purpose-built service for securely storing and managing secrets such as database credentials. It natively supports automatic rotation of secrets for Amazon RDS, allowing you to configure a rotation schedule without building custom automation. The service also integrates with AWS Lambda to rotate credentials for other services, and it enforces fine-grained access control via IAM policies, ensuring that only authorized EC2 instances can retrieve the current credentials.
✗AWS Systems Manager Parameter StoreWrong answer — click to see why▾
Why this is wrong here
AWS Systems Manager Parameter Store does not support automatic rotation of database credentials; it requires manual updates or custom automation via AWS Lambda, whereas the question specifies a need for a managed service that automatically rotates credentials on a schedule.
★ When this WOULD be the correct answer
A company needs to store configuration data (e.g., database URLs, application settings) that does not require automatic rotation, and they want a simple, low-cost solution integrated with AWS Systems Manager for operational management.
Why candidates choose this
Candidates may confuse Parameter Store with Secrets Manager because both can store secrets, but they overlook that Parameter Store lacks built-in automatic rotation, which is a key requirement in the question.
✗AWS Identity and Access Management (IAM) rolesWrong answer — click to see why▾
Why this is wrong here
IAM roles cannot store or rotate database credentials; they provide temporary permissions for AWS API actions, not authentication credentials for RDS MySQL. The question requires a managed service for storing and rotating database credentials, which IAM roles do not support.
★ When this WOULD be the correct answer
A correct scenario would be: 'A company runs an application on EC2 that needs to access an S3 bucket. The security team wants to avoid storing AWS access keys on the EC2 instance. Which AWS feature should they use?' In that case, an IAM role attached to the EC2 instance would provide temporary credentials for API access.
Why candidates choose this
Candidates may confuse IAM roles with credential management because IAM roles can provide temporary credentials for AWS services, but they do not manage or rotate database passwords for RDS.
✗AWS Key Management Service (AWS KMS)Wrong answer — click to see why▾
Why this is wrong here
AWS KMS is a key management service for encryption keys, not a service for storing or rotating database credentials. It does not provide automatic rotation of secrets like database passwords.
★ When this WOULD be the correct answer
A company needs to encrypt data at rest in an S3 bucket using a customer-managed key and must be able to rotate the key annually. AWS KMS would be the correct service to create, manage, and rotate the encryption keys.
Why candidates choose this
Candidates may confuse KMS with Secrets Manager because both involve 'keys' and 'secrets,' and KMS can be used to encrypt secrets stored elsewhere, but it does not store or rotate credentials itself.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on CLF-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS for MySQL database. Currently, the database administrator (DBA) hardcodes the database password in the application configuration file. A recent security audit recommends removing the password from the code and implementing automated password rotation every 30 days. The company wants a managed AWS service that can store the password securely and rotate it on a schedule without requiring custom code. Which AWS service should the company use?
medium- A.AWS KMS (Key Management Service)
- B.AWS Systems Manager Parameter Store
- ✓ C.AWS Secrets Manager
- D.AWS IAM (Identity and Access Management)
Why C: AWS Secrets Manager is the correct choice because it is a managed service specifically designed to securely store database credentials and other secrets, with built-in capability to automatically rotate passwords on a defined schedule (e.g., every 30 days) without requiring custom code. It integrates natively with Amazon RDS for MySQL, enabling automated rotation of the master user password via a pre-built Lambda function, which directly addresses the security audit's requirement to remove hardcoded passwords and implement rotation.
Variation 2. A company runs a web application on Amazon EC2 that connects to an Amazon RDS database. The database credentials are currently hardcoded in the application configuration file. The security team requires that the credentials be automatically rotated every 90 days and that the application retrieves them securely from a managed service without storing them in the application code. Which AWS service should the company use to meet these requirements?
medium- A.AWS Key Management Service (AWS KMS)
- ✓ B.AWS Secrets Manager
- C.AWS Systems Manager Parameter Store
- D.AWS Certificate Manager (ACM)
Why B: AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials (including for Amazon RDS) on a schedule. It allows the application to fetch credentials at runtime via API calls, eliminating hardcoded secrets, and supports native rotation every 90 days without custom code.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.