CLF-C02 Security and Compliance Practice Question
A company's security team discovers that database credentials are stored in plaintext in application configuration files. The team wants to implement a secure way to store, manage, and automatically rotate these credentials every 90 days. The solution must provide fine-grained IAM policies to control which users and applications can access the secrets and must integrate with AWS services like Amazon RDS for automatic rotation. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
Watch out — candidates often confuse AWS Systems Manager Parameter Store (which can store secrets but lacks native rotation) with Secrets Manager, leading them to choose Parameter Store when the question explicitly requires automatic rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct service because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It supports automatic rotation every 90 days for Amazon RDS, Aurora, Redshift, and DocumentDB with built-in Lambda rotation functions, and it integrates with IAM for fine-grained access control via resource-based and identity-based policies.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store, while capable of securely storing sensitive data using SecureString parameters and offering fine-grained IAM control, lacks the native capability for automatic credential rotation, particularly with direct integration for services like Amazon RDS. This is a core requirement of the scenario. Parameter Store is ideal for managing application configuration data and static secrets that do not require automated lifecycle management or rotation, making it a tempting but ultimately unsuitable choice here.
When this WOULD be correct
A company needs to store configuration data (e.g., database endpoints, AMI IDs) that does not require automatic rotation or fine-grained access policies. The solution must be cost-effective and integrate with EC2, Lambda, or other AWS services via simple parameter retrieval.
- ✓
AWS Secrets Manager
Why this is correct
Secrets Manager is the correct service. It provides native support for automatic rotation of credentials, including built-in integration with Amazon RDS. It also offers fine-grained IAM policies and central management of secrets, meeting all stated requirements.
- ✗
AWS Key Management Service (AWS KMS)
Why it's wrong here
AWS KMS is a managed service for creating, storing, and controlling the cryptographic keys used to encrypt data; it is not a store for application secrets such as database credentials. While KMS can encrypt a secret at rest, it does not hold the credential, expose a retrieval API, or provide scheduled rotation of the secret's value. The scenario demands a service that not only protects the secret but also automatically rotates it and enforces fine-grained IAM policies on the secret itself, which is outside KMS's purpose.
When this WOULD be correct
A company needs to encrypt data at rest in an S3 bucket and wants to use a customer-managed key with automatic annual rotation. AWS KMS would be the correct service to create and manage the encryption key.
- ✗
AWS Identity and Access Management (IAM)
Why it's wrong here
IAM manages user identities, permissions, and access to AWS resources. It cannot store secrets or rotate credentials. Using IAM roles is a best practice for temporary credentials, but the question specifically requires storing and rotating long-lived database credentials.
When this WOULD be correct
A question asking which AWS service is used to define fine-grained permissions for users and applications to access AWS resources, such as controlling access to an S3 bucket or EC2 instances, would have IAM as the correct answer.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Secrets ManagerCorrect answer▾
Why this is correct
Secrets Manager is the correct service. It provides native support for automatic rotation of credentials, including built-in integration with Amazon RDS. It also offers fine-grained IAM policies and central management of secrets, meeting all stated requirements.
✗AWS Systems Manager Parameter StoreWrong answer — click to see why▾
Why this is wrong here
AWS Systems Manager Parameter Store does not support automatic rotation of secrets; it requires custom solutions for rotation. It also lacks fine-grained IAM policies for secret access control compared to Secrets Manager.
★ When this WOULD be the correct answer
A company needs to store configuration data (e.g., database endpoints, AMI IDs) that does not require automatic rotation or fine-grained access policies. The solution must be cost-effective and integrate with EC2, Lambda, or other AWS services via simple parameter retrieval.
Why candidates choose this
Candidates may confuse Parameter Store with Secrets Manager because both can store secrets, but they overlook the specific requirements for automatic rotation and fine-grained IAM policies that are unique to Secrets Manager.
✗AWS Key Management Service (AWS KMS)Wrong answer — click to see why▾
Why this is wrong here
AWS KMS is a key management service for encryption keys, not for storing and rotating secrets like database credentials. It does not provide automatic rotation of secrets or fine-grained IAM policies for secret access.
★ When this WOULD be the correct answer
A company needs to encrypt data at rest in an S3 bucket and wants to use a customer-managed key with automatic annual rotation. AWS KMS would be the correct service to create and manage the encryption key.
Why candidates choose this
Candidates may confuse KMS with Secrets Manager because both involve encryption and rotation, but KMS manages encryption keys, not secrets like credentials.
✗AWS Identity and Access Management (IAM)Wrong answer — click to see why▾
Why this is wrong here
IAM is used for managing users, groups, roles, and permissions, not for storing, managing, or rotating secrets like database credentials. It does not provide secret storage or automatic rotation capabilities.
★ When this WOULD be the correct answer
A question asking which AWS service is used to define fine-grained permissions for users and applications to access AWS resources, such as controlling access to an S3 bucket or EC2 instances, would have IAM as the correct answer.
Why candidates choose this
Candidates may confuse IAM's role in access control with secret management, thinking that IAM policies alone can secure credentials, but IAM does not store or rotate secrets.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.