CLF-C02 Security and Compliance Practice Question
A company runs a web application on Amazon EC2 that connects to an Amazon RDS database. The database credentials are currently hardcoded in the application configuration file. The security team requires that the credentials be automatically rotated every 90 days and that the application retrieves them securely from a managed service without storing them in the application code. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Candidates often confuse AWS Systems Manager Parameter Store with Secrets Manager because both can store secrets, but Parameter Store lacks native automatic rotation, which is explicitly required in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, retrieving, and automatically rotating database credentials (including for Amazon RDS) on a schedule. It allows the application to fetch credentials at runtime via API calls, eliminating hardcoded secrets, and supports native rotation every 90 days without custom code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Key Management Service (AWS KMS)
Why it's wrong here
AWS Key Management Service (AWS KMS) is a managed service for creating and controlling customer master keys (CMKs) used for envelope encryption across AWS services and applications. While KMS can encrypt data, including secret values, it does not store the secret itself; it only provides cryptographic operations such as Encrypt, Decrypt, and GenerateDataKey. KMS lacks the built-in lifecycle management to automatically rotate RDS database credentials, which requires coordinated updates to both the database and the secret store—a capability unique to AWS Secrets Manager, which uses KMS only to encrypt the secret at rest.
When this WOULD be correct
A company needs to encrypt data at rest in Amazon S3 using a customer-managed key with automatic annual rotation. AWS KMS would be the correct service to create and manage the encryption key with scheduled rotation.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is the correct service because it stores database credentials securely, allows retrieval via API calls, and can automatically rotate credentials for supported services like Amazon RDS on a defined schedule (e.g., every 90 days).
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
While Parameter Store can store sensitive configuration data, it lacks the native integration required to perform automatic credential rotation for Amazon RDS. It is a tempting choice because it provides secure storage for application settings and secrets; however, it functions as a hierarchical key-value store rather than an orchestration service. You would select this when you need to manage non-rotating environment variables or configuration strings without requiring automated lifecycle management.
When this WOULD be correct
A company needs to store configuration data (e.g., database URLs, AMI IDs) that does not require rotation, and wants to retrieve them securely without managing a separate service. Parameter Store would be correct for non-secret configuration data.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
AWS Certificate Manager (ACM) provisions, manages, and deploys public and private SSL/TLS certificates for use with integrated AWS services such as Application Load Balancers, CloudFront, and API Gateway. It automatically renews certificates but has no mechanism for storing arbitrary secrets like database usernames or passwords, nor does it perform credential rotation against Amazon RDS. Therefore, an application connecting to a database cannot retrieve database credentials from ACM.
When this WOULD be correct
A company needs to automatically renew and deploy SSL/TLS certificates for a web application running on an Application Load Balancer to enable HTTPS connections.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Secrets ManagerCorrect answer▾
Why this is correct
AWS Secrets Manager is the correct service because it stores database credentials securely, allows retrieval via API calls, and can automatically rotate credentials for supported services like Amazon RDS on a defined schedule (e.g., every 90 days).
✗AWS Key Management Service (AWS KMS)Wrong answer — click to see why▾
Why this is wrong here
AWS KMS is a key management service for encryption keys, not for storing or rotating secrets like database credentials. It does not provide automatic rotation of secrets or a secure retrieval API for application credentials.
★ When this WOULD be the correct answer
A company needs to encrypt data at rest in Amazon S3 using a customer-managed key with automatic annual rotation. AWS KMS would be the correct service to create and manage the encryption key with scheduled rotation.
Why candidates choose this
Candidates may confuse key management with secret management, assuming that since credentials are sensitive, a service that manages encryption keys (KMS) can also handle credential rotation and storage.
✗AWS Systems Manager Parameter StoreWrong answer — click to see why▾
Why this is wrong here
AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it requires custom solutions (e.g., Lambda functions) to rotate credentials, whereas Secrets Manager provides built-in automatic rotation.
★ When this WOULD be the correct answer
A company needs to store configuration data (e.g., database URLs, AMI IDs) that does not require rotation, and wants to retrieve them securely without managing a separate service. Parameter Store would be correct for non-secret configuration data.
Why candidates choose this
Candidates may confuse Parameter Store's secure storage and integration with EC2/RDS for automatic rotation, not realizing that Secrets Manager is the dedicated service for rotating secrets.
✗AWS Certificate Manager (ACM)Wrong answer — click to see why▾
Why this is wrong here
AWS Certificate Manager (ACM) is used to provision, manage, and deploy public and private SSL/TLS certificates, not for storing or rotating database credentials.
★ When this WOULD be the correct answer
A company needs to automatically renew and deploy SSL/TLS certificates for a web application running on an Application Load Balancer to enable HTTPS connections.
Why candidates choose this
Candidates may confuse ACM with Secrets Manager because both involve 'secrets' (certificates vs. credentials) and automatic rotation, leading to a mistaken association.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
Courseiva writes every CLF-C02 question from scratch — 988 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.