DVA-C02 Security Practice Question
A company is using AWS Secrets Manager to rotate database credentials automatically. The rotation Lambda function fails with a timeout. Which action should be taken to resolve this issue?
⚠ Common exam trap
Candidates often confuse a timeout with a network issue and incorrectly choose to place the Lambda in a VPC with a NAT gateway, when the real problem is simply that the default execution duration is too short for the rotation logic.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Increase the Lambda function timeout.
The Lambda function is timing out during the rotation process, which indicates that the default 3-second timeout is insufficient for the rotation logic. Increasing the Lambda function timeout (Option B) directly addresses this by allowing the function more time to complete the rotation, such as calling the Secrets Manager API, updating the database, and verifying the new credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Reduce the rotation schedule interval.
Why it's wrong here
Reducing the rotation schedule interval means the system attempts to rotate credentials more frequently, but it does not address the fundamental problem of the rotation process itself exceeding its allotted execution time. If the Lambda function responsible for rotation is timing out, simply scheduling it to run more often will only result in more frequent timeout failures, rather than allowing a single rotation attempt to successfully complete within its duration.
- ✓
Increase the Lambda function timeout.
Why this is correct
AWS Secrets Manager leverages a Lambda function to execute the actual database credential rotation logic. When this Lambda function's execution duration exceeds its configured timeout setting, the function is forcibly terminated, preventing the successful completion of the rotation process. Increasing the Lambda function's timeout directly provides more execution time, allowing the rotation logic to connect to the database, modify credentials, and update Secrets Manager without premature termination.
- ✗
Place the Lambda function in a VPC with a NAT gateway.
Why it's wrong here
Placing the Lambda function in a Virtual Private Cloud (VPC) with a NAT Gateway is primarily a networking configuration to enable the Lambda to access private resources within the VPC (e.g., an RDS instance in a private subnet) and also make outbound connections to the internet. While network connectivity issues can indirectly cause delays, this configuration does not directly resolve a timeout that occurs because the *rotation logic itself* is taking too long to execute, assuming the Lambda already has the necessary network path to the database.
- ✗
Store the rotation schedule in EC2 user data.
Why it's wrong here
EC2 user data is a mechanism used to pass configuration scripts or commands to an Amazon EC2 instance when it is launched, primarily for bootstrapping and initial setup. AWS Secrets Manager's rotation schedule, however, is an integral part of the Secrets Manager service configuration and is managed directly within the service itself, often configured via the AWS Management Console, CLI, or SDK. These two mechanisms are entirely distinct and unrelated; EC2 user data has no role in defining or controlling Secrets Manager rotation schedules.
Visual reference
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DVA-C02 question is part of Courseiva's 724-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.