DVA-C02 Security Practice Question
A company uses AWS Secrets Manager to rotate database credentials for an RDS MySQL instance. The rotation Lambda function fails with the error: 'Secret is scheduled for deletion.' What is the MOST likely cause?
⚠ Common exam trap
Watch out — candidates often confuse the 'scheduled for deletion' error with a permissions or network issue, but the error message directly points to the secret's lifecycle state, which is a distinct concept in AWS Secrets Manager.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The secret has been marked for deletion and is in the waiting period.
The error 'Secret is scheduled for deletion' indicates that the secret has been marked for deletion and is currently in the mandatory waiting period (default 7 to 30 days). During this period, AWS Secrets Manager prevents any operations on the secret, including rotation, to ensure the deletion is intentional. The rotation Lambda function fails because it cannot access or modify a secret that is pending deletion.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
The secret has been marked for deletion and is in the waiting period.
Why this is correct
When a secret in AWS Secrets Manager is marked for deletion, it enters a configurable waiting period (3 to 30 days) before permanent removal. During this period, the secret is effectively read-only and cannot be modified, including initiating a rotation. Any attempt to rotate a secret in this state will fail, as Secrets Manager prevents operations that would alter a secret designated for deletion, ensuring data integrity before its final removal. This specific state directly causes rotation failures.
- ✗
The secret's rotation schedule has been disabled.
Why it's wrong here
Disabling a secret's rotation schedule in AWS Secrets Manager simply stops the automatic invocation of the rotation Lambda function. It does not generate an error or failure message when a rotation *attempt* is made, because no rotation attempt is being triggered by the schedule itself. If a manual rotation were attempted, it would still proceed unless other issues were present, but the disabled schedule itself is not an error condition.
- ✗
The Lambda function does not have permission to access the secret.
Why it's wrong here
If the AWS Lambda function configured for secret rotation lacks the necessary IAM permissions (e.g., secretsmanager:GetSecretValue, secretsmanager:PutSecretValue, secretsmanager:UpdateSecretVersionStage) to interact with the secret, the rotation attempt would fail with an explicit "Access Denied" error. This is a distinct error message indicating an authorization failure, not a state where the secret itself prevents rotation due to its lifecycle status. The error would clearly point to an IAM policy issue.
- ✗
The RDS instance is not in the same VPC as the Lambda function.
Why it's wrong here
A mismatch in VPC configuration between the rotation Lambda function and the target Amazon RDS instance would lead to network connectivity issues. The Lambda function would be unable to establish a connection to the database, resulting in a timeout or network unreachable error during the rotation process. This is a network-level failure, distinct from an error indicating that the secret itself is in a state preventing rotation, such as being marked for deletion.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.