- A
AWS KMS (Key Management Service)
Why wrong: KMS is used to create and manage encryption keys, not to store application secrets like database passwords. While it can encrypt data, it does not provide secret storage or scheduled rotation.
- B
AWS Systems Manager Parameter Store
Why wrong: Parameter Store can store secure strings (using KMS encryption), but it does not have native capability to automatically rotate secrets on a schedule. Custom automation (e.g., with Lambda) is required for rotation, which the company wants to avoid.
- C
AWS Secrets Manager
Secrets Manager is designed for securely storing secrets such as database credentials, API keys, and other sensitive data. It offers built-in automatic secret rotation with integration to RDS and other services, meeting the requirement without custom code.
- D
AWS IAM (Identity and Access Management)
Why wrong: IAM manages users, groups, roles, and permissions, not the storage of application secrets. It is not designed to store or rotate database passwords.
CLF-C02 Security and Compliance Practice Question
This CLF-C02 practice question tests your understanding of security and compliance. This is a configuration task: choose the command set that satisfies every stated requirement. Small differences — like 'secret' vs 'password' or 'transport input ssh' vs 'all' — change whether the answer is correct. A key principle to apply: aWS Secrets Manager securely stores and manages secrets like database credentials.. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company runs a web application on Amazon EC2 instances that connect to an Amazon RDS for MySQL database. Currently, the database administrator (DBA) hardcodes the database password in the application configuration file. A recent security audit recommends removing the password from the code and implementing automated password rotation every 30 days. The company wants a managed AWS service that can store the password securely and rotate it on a schedule without requiring custom code. Which AWS service should the company use?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is a managed service specifically designed to securely store database credentials and other secrets, with built-in capability to automatically rotate passwords on a defined schedule (e.g., every 30 days) without requiring custom code. It integrates natively with Amazon RDS for MySQL, enabling automated rotation of the master user password via a pre-built Lambda function, which directly addresses the security audit's requirement to remove hardcoded passwords and implement rotation.
Key principle: AWS Secrets Manager securely stores and manages secrets like database credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS KMS (Key Management Service)
Why it's wrong here
KMS is used to create and manage encryption keys, not to store application secrets like database passwords. While it can encrypt data, it does not provide secret storage or scheduled rotation.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
Parameter Store can store secure strings (using KMS encryption), but it does not have native capability to automatically rotate secrets on a schedule. Custom automation (e.g., with Lambda) is required for rotation, which the company wants to avoid.
- ✓
AWS Secrets Manager
Why this is correct
Secrets Manager is designed for securely storing secrets such as database credentials, API keys, and other sensitive data. It offers built-in automatic secret rotation with integration to RDS and other services, meeting the requirement without custom code.
Related concept
AWS Secrets Manager securely stores and manages secrets like database credentials.
- ✗
AWS IAM (Identity and Access Management)
Why it's wrong here
IAM manages users, groups, roles, and permissions, not the storage of application secrets. It is not designed to store or rotate database passwords.
Common exam traps
Common exam trap: answer the scenario, not the keyword
The trap here is that candidates confuse AWS Systems Manager Parameter Store with Secrets Manager because both can store encrypted strings, but Parameter Store lacks native automated rotation, which is the critical requirement in this question.
Detailed technical explanation
How to think about this question
AWS Secrets Manager uses an integrated AWS Lambda function (provided by AWS for supported RDS engines) to perform rotation: it creates a new password, updates the RDS instance, tests the new credential, and marks the old one as pending—all while maintaining application availability via a staging mechanism. The rotation schedule is defined using a cron expression or rate expression (e.g., 'rate(30 days)'), and the secret version is automatically tracked with a unique staging label (e.g., AWSCURRENT, AWSPREVIOUS) to support safe rotation without downtime.
KKey Concepts to Remember
- AWS Secrets Manager securely stores and manages secrets like database credentials.
- It offers built-in, automated secret rotation for services like Amazon RDS.
- Applications retrieve secrets at runtime, eliminating hardcoded credentials.
- Secrets Manager integrates with AWS KMS for encryption of stored secrets.
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
AWS Secrets Manager securely stores and manages secrets like database credentials.
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review aWS Secrets Manager securely stores and manages secrets like database credentials., then practise related CLF-C02 questions on the same topic to reinforce the concept.
- →
Security and Compliance — study guide chapter
Learn the concepts, then practise the questions
- →
Security and Compliance practice questions
Targeted practice on this topic area only
- →
All CLF-C02 questions
1,024 questions across all exam domains
- →
AWS Certified Cloud Practitioner CLF-C02 study guide
Full concept coverage aligned to exam objectives
- →
CLF-C02 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related CLF-C02 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Cloud Concepts practice questions
Practise CLF-C02 questions linked to Cloud Concepts.
Security and Compliance practice questions
Practise CLF-C02 questions linked to Security and Compliance.
Cloud Technology and Services practice questions
Practise CLF-C02 questions linked to Cloud Technology and Services.
Billing, Pricing, and Support practice questions
Practise CLF-C02 questions linked to Billing, Pricing, and Support.
AWS shared responsibility model practice questions
Practise CLF-C02 questions linked to AWS shared responsibility model.
AWS IAM practice questions
Practise CLF-C02 questions linked to AWS IAM.
AWS pricing practice questions
Practise CLF-C02 questions linked to AWS pricing.
AWS support plans practice questions
Practise CLF-C02 questions linked to AWS support plans.
AWS S3 practice questions
Practise CLF-C02 questions linked to AWS S3.
AWS EC2 practice questions
Practise CLF-C02 questions linked to AWS EC2.
Practice this exam
Start a free CLF-C02 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this CLF-C02 question test?
Security and Compliance — This question tests Security and Compliance — AWS Secrets Manager securely stores and manages secrets like database credentials..
What is the correct answer to this question?
The correct answer is: AWS Secrets Manager — AWS Secrets Manager is the correct choice because it is a managed service specifically designed to securely store database credentials and other secrets, with built-in capability to automatically rotate passwords on a defined schedule (e.g., every 30 days) without requiring custom code. It integrates natively with Amazon RDS for MySQL, enabling automated rotation of the master user password via a pre-built Lambda function, which directly addresses the security audit's requirement to remove hardcoded passwords and implement rotation.
What should I do if I get this CLF-C02 question wrong?
Review aWS Secrets Manager securely stores and manages secrets like database credentials., then practise related CLF-C02 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
AWS Secrets Manager securely stores and manages secrets like database credentials.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Last reviewed: Jun 11, 2026
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.