DBS-C01 AWS Secrets Manager Practice Question
Which TWO AWS services can be used to centrally manage database credentials and automate rotation for Amazon RDS? (Choose two.)
⚠ Common exam trap
A common trap is assuming only AWS Secrets Manager can support automated rotation. However, AWS Systems Manager Parameter Store can also achieve rotation through custom automation (e.g., Lambda), making it a valid answer for this question.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
Options A and D are correct. AWS Secrets Manager provides native automated rotation for RDS credentials, while AWS Systems Manager Parameter Store (SecureString) can centrally store encrypted credentials and support automated rotation when combined with a custom AWS Lambda function. Both services allow centralized management of database credentials, and with additional configuration, both can automate rotation. Option B (AWS KMS) is incorrect because KMS manages encryption keys, not secrets. Option C (IAM database authentication) is incorrect because it eliminates the need for stored credentials but does not centrally manage or rotate them. Option E (AWS CloudHSM) is incorrect because it provides hardware security modules for key storage, not secret management.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager can store and automatically rotate RDS credentials.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
AWS KMS manages encryption keys, not secrets, so it cannot centrally manage database credentials.
- ✗
IAM database authentication
Why it's wrong here
IAM database authentication allows using IAM users/roles to authenticate to RDS without storing credentials, but it does not centrally manage credentials or automate rotation.
- ✓
AWS Systems Manager Parameter Store
Why this is correct
AWS Systems Manager Parameter Store can store RDS credentials as SecureString parameters, but it does not have built-in rotation (though you can use Lambda for rotation).
- ✗
AWS CloudHSM
Why it's wrong here
AWS CloudHSM provides hardware security modules for key storage, not for managing database credentials.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This DBS-C01 question is part of Courseiva's 1,663-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DBS-C01
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to centrally manage database user credentials and rotate them automatically. The database is an Amazon RDS for MySQL instance. Which AWS service should be used?
easy- ✓ A.AWS Secrets Manager
- B.AWS CloudHSM
- C.AWS Identity and Access Management (IAM)
- D.AWS Systems Manager Parameter Store
Why A: AWS Secrets Manager (option A) is the correct service because it is designed to centrally manage database credentials and can automatically rotate them for Amazon RDS for MySQL instances on a schedule you define. Option B (AWS CloudHSM) provides hardware security modules for cryptographic key storage, not credential management or rotation. Option C (IAM) is used for controlling access to AWS resources and supports IAM database authentication for RDS, but it does not manage database user passwords or provide automatic rotation of those passwords. Option D (AWS Systems Manager Parameter Store) can store secrets securely, but it does not offer native automatic rotation of RDS database credentials; that functionality requires Secrets Manager.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DBS-C01 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DBS-C01 exam.