DVA-C02 Development with AWS Services Practice Question
A developer is using AWS Secrets Manager to rotate database credentials. The rotation Lambda function fails with an error. Which THREE steps should the developer take to troubleshoot? (Choose THREE.)
⚠ Common exam trap
It's easy for candidates to confuse VPC Flow Logs (which show network traffic) with CloudWatch Logs (which show application logs), and they may think that rotating the KMS key is necessary for secret rotation, when in fact KMS key rotation is automatic and unrelated to the rotation process.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify that the Lambda function has network access to the database.
The Lambda function must have network access to the database to perform the rotation (e.g., connecting to the database to change the password). Without network connectivity, the rotation cannot complete. Option D is correct because the Lambda function's IAM role needs permission to call `secretsmanager:PutSecretValue` and `secretsmanager:GetSecretValue` to update the secret in Secrets Manager. Option E is correct because CloudWatch Logs capture the Lambda function's execution output, including any error messages, stack traces, or logs from the rotation logic, which are essential for diagnosing failures.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Check VPC Flow Logs for the Lambda function's ENI.
Why it's wrong here
VPC Flow Logs record IP traffic going to and from network interfaces, indicating if packets are dropped due to security group or NACL rules. However, they do not provide insight into application-level errors within the Lambda function, such as database authentication failures, incorrect SQL commands, or issues with the rotation logic itself. Flow logs are primarily for network connectivity diagnostics, not application debugging.
- ✓
Verify that the Lambda function has network access to the database.
Why this is correct
For the Lambda function to successfully rotate database credentials, it must establish a network connection to the database instance. If the database resides within a VPC, the Lambda function must be configured to execute within that same VPC or a peered VPC, with appropriate security groups and network ACLs allowing outbound connections to the database's port and inbound connections from the Lambda's Elastic Network Interface (ENI). Lack of network reachability is a common cause of rotation failures.
- ✗
Ensure the KMS key used to encrypt the secret is rotated.
Why it's wrong here
AWS Secrets Manager automatically encrypts secrets using an AWS KMS key. While KMS key rotation is a security best practice for compliance, it only affects the underlying encryption key used by KMS and does not impact the functionality of the Secrets Manager rotation Lambda function itself. The rotation function's failure would stem from issues with its execution, permissions, or network access, not the lifecycle of the secret's encryption key.
- ✓
Verify that the Lambda function's IAM role has permission to update the secret.
Why this is correct
The Lambda function responsible for rotating the secret needs specific AWS Identity and Access Management (IAM) permissions to interact with Secrets Manager. This includes permissions like `secretsmanager:GetSecretValue` to retrieve the current secret, `secretsmanager:PutSecretValue` to store the new secret, and potentially `secretsmanager:UpdateSecret` or `secretsmanager:DescribeSecret` during the rotation process. Without these necessary permissions, the Lambda function will fail to update the secret in Secrets Manager, leading to a rotation failure.
- ✓
Check the CloudWatch Logs for the Lambda function.
Why this is correct
CloudWatch Logs provide detailed execution logs for Lambda functions, capturing `stdout` and `stderr` output. When a Secrets Manager rotation function fails, its logs in CloudWatch will typically contain specific error messages, stack traces, and any custom logging statements from the function's code. These logs are crucial for diagnosing the exact cause of the failure, whether it's a code error, a timeout, a permissions issue, or a database connection problem.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 724 original DVA-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DVA-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DVA-C02 exam.