DEA-C01 Data Security and Governance Practice Question
A company uses Amazon RDS for MySQL to store application data. The security team requires that all database credentials be rotated automatically every 90 days. The data engineer needs to implement a solution that minimizes operational overhead. The database credentials are stored in AWS Secrets Manager. The application retrieves the credentials at startup and caches them for the duration of the session. The application is deployed on Amazon ECS with Fargate. Which solution should the data engineer implement to meet the rotation requirement with minimal overhead?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Secrets Manager's automatic rotation feature with a custom Lambda function that updates the RDS password.
Secrets Manager's automatic rotation feature, combined with a custom Lambda function to update the RDS password, provides a fully automated, low-overhead solution. Option A is incorrect because Parameter Store does not natively support automatic rotation and would require additional automation. Option C is incorrect because it involves manual steps to update the application configuration, increasing operational overhead. Option D is incorrect because IAM database authentication does not rotate credentials automatically and would require significant application changes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the credentials in AWS Systems Manager Parameter Store and use a scheduled job to update the password.
Why it's wrong here
Parameter Store does not have native rotation; would require custom automation.
- ✓
Use Secrets Manager's automatic rotation feature with a custom Lambda function that updates the RDS password.
Why this is correct
Secrets Manager can rotate secrets automatically with a Lambda.
- ✗
Create a scheduled Lambda function that updates the password in Secrets Manager and manually updates the application configuration.
Why it's wrong here
Manual update of application config is not automatic and has overhead.
- ✗
Configure IAM database authentication for the RDS instance and update the application to use IAM credentials.
Why it's wrong here
IAM auth does not rotate credentials automatically; tokens expire but need re-authentication.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DEA-C01 question is part of Courseiva's 1,711-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DEA-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DEA-C01 exam.