DBS-C01 Database Security Practice Question
A company's security policy requires that all database passwords be rotated every 90 days. The company uses AWS Secrets Manager to store database credentials for Amazon RDS. Which feature can be used to automate password rotation?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure automatic rotation in Secrets Manager with a rotation interval of 90 days.
Secrets Manager has built-in rotation support for RDS databases. Option B is wrong because Lambda can be used but is not a feature of Secrets Manager itself; the managed rotation is the simplest. Option C is wrong because IAM Access Analyzer is for analyzing resource policies, not password rotation. Option D is wrong because Systems Manager Parameter Store does not have built-in rotation for RDS.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Configure automatic rotation in Secrets Manager with a rotation interval of 90 days.
Why this is correct
Secrets Manager can automatically rotate RDS credentials on a schedule.
- ✗
Use an AWS Lambda function triggered by Amazon CloudWatch Events every 90 days to rotate the password.
Why it's wrong here
Using a custom Lambda function triggered by CloudWatch Events fails because AWS Secrets Manager provides native, integrated rotation for Amazon RDS credentials. This feature leverages pre-built, managed Lambda functions to handle the entire rotation lifecycle, including updating the secret and the database password automatically. While Lambda and CloudWatch Events are excellent for general-purpose custom automation and scheduled tasks, such as rotating API keys for external services, they are not the designated mechanism for automating database password rotation when Secrets Manager's native capabilities are available for RDS.
- ✗
Use IAM Access Analyzer to detect unused passwords and rotate them.
Why it's wrong here
IAM Access Analyzer analyzes resource policies, not passwords.
- ✗
Store the password in AWS Systems Manager Parameter Store and use automatic rotation.
Why it's wrong here
Parameter Store does not have built-in rotation for RDS credentials.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.