CLF-C02 Security and Compliance Practice Question
A company stores database passwords for their RDS instances and API keys for third-party services in their application code, which is a security risk. They want a managed service that securely stores these secrets, makes them available to applications via API, and automatically rotates database passwords. Which AWS service should they use?
⚠ Common exam trap
Candidates often confuse AWS Systems Manager Parameter Store with Secrets Manager because both can store secrets, but Parameter Store lacks native automatic rotation for RDS passwords, which is the key requirement in the question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is a fully managed service specifically designed to securely store, retrieve, and automatically rotate secrets such as database passwords and API keys. It provides built-in integration with RDS for automatic rotation of database credentials without custom code, and it serves secrets via a secure API call, eliminating the need to hardcode secrets in application code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS KMS
Why it's wrong here
AWS KMS is a cryptographic key management service that creates, stores, and controls customer master keys used to encrypt data. Secrets Manager uses KMS keys to encrypt the secret payload, but KMS itself has no concept of database credentials or a rotation schedule. It is a foundational service that supports encryption, not a secrets management service capable of directly storing or rotating passwords.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store can store configuration values and secrets, but it lacks native automatic rotation for RDS database passwords. Without built-in rotation, you must manually update the stored value or build a custom AWS Lambda function to handle rotation, adding complexity and risk. Secrets Manager is the purpose-built service that provides fully managed rotation through pre-built Lambda integrations and directly manages the secret lifecycle.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is purpose-built for securely storing, retrieving, and automatically rotating database credentials. It encryptes secrets with KMS keys, retrieves them via API to eliminate hardcoded passwords, and integrates natively with RDS to rotate passwords on a configurable schedule. The service manages both the stored secret and the database password in sync, ensuring applications continue to work during rotation without downtime.
- ✗
Amazon Cognito
Why it's wrong here
Amazon Cognito is designed for end-user identity and access management, not for storing application secrets. User pools authenticate users and issue tokens, while identity pools exchange these tokens for temporary AWS credentials, but neither has any integration with RDS to manage database passwords. It simply lacks the ability to store arbitrary secrets or perform automatic rotation, making it irrelevant for this use case.
Go deeper
Related to this question
About these practice questions
This CLF-C02 question is part of Courseiva's 988-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CLF-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CLF-C02 exam.