DVA-C02 Security Practice Question
A company has a requirement to automatically rotate database credentials every 30 days. Which AWS service can meet this requirement with minimal development effort?
⚠ Common exam trap
Many candidates confuse Systems Manager Parameter Store (which can store secrets but lacks automatic rotation) with Secrets Manager, overlooking the critical requirement for automated rotation with minimal effort.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct choice because it provides built-in, automated rotation of database credentials without custom code. You can define a rotation schedule (e.g., every 30 days) and Secrets Manager will automatically update the secret and the database password using a Lambda function, meeting the requirement with minimal development effort.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS KMS
Why it's wrong here
AWS Key Management Service (KMS) is a service for creating and managing cryptographic keys and controlling their use across various AWS services and applications. While KMS can encrypt secrets stored elsewhere, it does not provide the built-in functionality to automatically rotate database credentials or manage the lifecycle of the secret itself. Its primary role is data encryption at rest and in transit, not automated secret lifecycle management.
- ✗
AWS IAM
Why it's wrong here
AWS Identity and Access Management (IAM) is a web service that helps you securely control access to AWS resources. IAM is used to manage users, groups, roles, and their permissions to interact with AWS services, but it does not manage or rotate credentials for external resources like a database running on an EC2 instance or an RDS instance. It focuses on AWS-specific authentication and authorization, not third-party secret management.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store provides secure, hierarchical storage for configuration data management and secrets. While it can store database credentials as SecureString parameters, it lacks the native, automated rotation capabilities required to periodically change these secrets without manual intervention or custom scripting. It serves as a secure storage mechanism, not an automated rotation engine for database credentials.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is specifically designed to help you protect access to your applications, services, and IT resources by enabling you to easily rotate, manage, and retrieve database credentials, API keys, and other secrets throughout their lifecycle. It offers built-in, automated rotation for various database types, including Amazon RDS, Amazon DocumentDB, and other services, ensuring credentials are regularly updated without requiring application code changes.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 1,135-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.