CLF-C02 Security and Compliance Practice Question
A company uses an Amazon RDS for PostgreSQL database for its production application. The security policy requires that database passwords be rotated automatically every 90 days. The database credentials are currently stored in a configuration file on an Amazon EC2 instance. The company wants a fully managed AWS service that can securely store the credentials, automatically rotate them on a schedule, and update the RDS instance without requiring code changes to the application. Which AWS service should the company use to meet these requirements?
⚠ Common exam trap
It's easy for candidates to confuse AWS Systems Manager Parameter Store with Secrets Manager because both can store secrets, but Parameter Store lacks native automatic rotation and RDS integration, making it unsuitable for the rotation requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is a fully managed service designed specifically to securely store database credentials, automatically rotate them on a defined schedule (e.g., every 90 days), and natively integrate with Amazon RDS to update the password without requiring any application code changes. The application can retrieve the current credentials at runtime using the Secrets Manager API, eliminating the need for hardcoded or file-based credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is the correct service because it natively supports automatic rotation for Amazon RDS database credentials via built-in Lambda rotation functions. It directly updates the RDS password during rotation and can be configured on a schedule, eliminating the need for custom application code or manual credential updates. This tight integration with RDS makes it the purpose-built secrets management service for this use case.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
Parameter Store can store credentials, but it does not have native automatic rotation capability for RDS passwords. To achieve rotation, you would need to implement a custom AWS Lambda function and an AWS CloudWatch Events rule, which adds complexity.
When this WOULD be correct
A company needs to store configuration data (e.g., database connection strings, AMI IDs) securely and retrieve them via EC2 instance profiles or Lambda, but does not require automatic rotation of secrets. Parameter Store would be the cost-effective choice.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
KMS is used to create and manage encryption keys. It does not store secrets or perform password rotation. It can be used to encrypt secrets stored elsewhere, but it is not a secrets management service.
When this WOULD be correct
A company needs to encrypt data at rest in an Amazon S3 bucket using a customer-managed key with automatic annual rotation. AWS KMS would be the correct service to create and manage the encryption key with scheduled rotation.
- ✗
AWS Certificate Manager (ACM)
Why it's wrong here
AWS Certificate Manager is designed to provision, manage, and deploy SSL/TLS certificates for encrypting network traffic, not to store or rotate database credentials. It has no mechanism to update a PostgreSQL password or integrate with RDS authentication, so it cannot satisfy the requirement to automatically rotate database passwords. Therefore, ACM is incorrect for this scenario.
When this WOULD be correct
A company needs to automatically renew and deploy SSL/TLS certificates for a web application running on an Application Load Balancer. ACM can provision, renew, and associate certificates with AWS resources like ALB, CloudFront, or API Gateway without manual intervention.
Option-by-option analysis
Why each answer is right or wrong
Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The CLF-C02 exam frequently reuses these exact scenarios with slightly different constraints.
✓AWS Secrets ManagerCorrect answer▾
Why this is correct
AWS Secrets Manager is the correct service because it natively supports automatic rotation for Amazon RDS database credentials via built-in Lambda rotation functions. It directly updates the RDS password during rotation and can be configured on a schedule, eliminating the need for custom application code or manual credential updates. This tight integration with RDS makes it the purpose-built secrets management service for this use case.
✗AWS Systems Manager Parameter StoreWrong answer — click to see why▾
Why this is wrong here
AWS Systems Manager Parameter Store does not support automatic rotation of RDS database passwords; it only stores parameters securely. Secrets Manager is required for automated rotation.
★ When this WOULD be the correct answer
A company needs to store configuration data (e.g., database connection strings, AMI IDs) securely and retrieve them via EC2 instance profiles or Lambda, but does not require automatic rotation of secrets. Parameter Store would be the cost-effective choice.
Why candidates choose this
Candidates may confuse Parameter Store's secure storage capabilities with Secrets Manager's rotation feature, or assume Parameter Store can rotate secrets since it integrates with other AWS services.
✗AWS Key Management Service (KMS)Wrong answer — click to see why▾
Why this is wrong here
AWS KMS is a key management service for encryption keys, not for storing or rotating database credentials. It does not provide automatic rotation of passwords or direct integration with RDS for credential updates.
★ When this WOULD be the correct answer
A company needs to encrypt data at rest in an Amazon S3 bucket using a customer-managed key with automatic annual rotation. AWS KMS would be the correct service to create and manage the encryption key with scheduled rotation.
Why candidates choose this
Candidates may confuse KMS's key rotation capability with credential rotation, or think that because Secrets Manager uses KMS for encryption, KMS itself can handle credential rotation.
✗AWS Certificate Manager (ACM)Wrong answer — click to see why▾
Why this is wrong here
AWS Certificate Manager (ACM) is designed to manage SSL/TLS certificates, not database credentials. It cannot store or rotate database passwords, nor update RDS instances with new credentials.
★ When this WOULD be the correct answer
A company needs to automatically renew and deploy SSL/TLS certificates for a web application running on an Application Load Balancer. ACM can provision, renew, and associate certificates with AWS resources like ALB, CloudFront, or API Gateway without manual intervention.
Why candidates choose this
Candidates may confuse ACM's automatic rotation of certificates with the credential rotation requirement, mistakenly thinking ACM can handle any type of secret rotation.
Analysis generated from the official CLF-C02blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”
Go deeper
Related to this question
About these practice questions
One of 988 original CLF-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.