DVA-C02 Security Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Enable automatic rotation and choose a rotation interval of 30 days. Secrets Manager will automatically rotate the secret using a built-in Lambda function.

  Why it's wrong here

  This option is incorrect because AWS Secrets Manager does not provide a generic, built-in Lambda function that automatically rotates all secret types. While Secrets Manager facilitates rotation and offers pre-built Lambda templates for common AWS services like RDS or Redshift, a developer must still configure or provide a custom Lambda function containing the specific rotation logic for their secret. The service orchestrates the rotation, but the actual credential update logic resides within a user-managed or template-configured Lambda function, not a fully automatic, universal built-in one.

• ✓

  Create a Lambda function with rotation logic, attach an IAM role with permissions to read and update the secret, and configure Secrets Manager to invoke the function every 30 days.

  Why this is correct

  This is the correct approach for implementing secret rotation with AWS Secrets Manager. To enable automatic rotation, a dedicated AWS Lambda function must be created, containing the specific logic to generate a new secret, update it in the target service (e.g., a database), and then update Secrets Manager. This Lambda function requires an IAM role with precise permissions, including `secretsmanager:GetSecretValue` to retrieve the current secret and `secretsmanager:PutSecretValue` to store the new one, along with permissions to interact with the target resource. Secrets Manager is then configured to invoke this Lambda function on the specified schedule, such as every 30 days.

• ✗

  Use AWS Certificate Manager (ACM) to rotate the secret automatically every 30 days.

  Why it's wrong here

  This option is incorrect because AWS Certificate Manager (ACM) is a service specifically designed for provisioning, managing, and deploying SSL/TLS certificates for use with AWS services and connected resources. ACM's primary function is to handle the lifecycle of digital certificates, including their issuance and renewal, to secure network communications. It has no functionality or capability to store, manage, or rotate database credentials or any other type of secret managed by AWS Secrets Manager.

• ✗

  Store the secret in AWS Systems Manager Parameter Store and set a schedule to rotate it using a CloudWatch Events rule.

  Why it's wrong here

  This option is incorrect as AWS Systems Manager Parameter Store, while capable of storing sensitive information as SecureString parameters, does not offer native, built-in secret rotation capabilities like AWS Secrets Manager. Implementing rotation for a secret stored in Parameter Store would require significant custom development, including a Lambda function and a CloudWatch Events rule, essentially replicating a subset of Secrets Manager's functionality. Furthermore, the question explicitly states the company uses AWS Secrets Manager, making Parameter Store an unsuitable alternative for this scenario.