DOP-C02 Security and Compliance Practice Question
A company has a requirement to rotate database credentials every 30 days for an Amazon RDS for MySQL instance. The credentials are currently stored in AWS Secrets Manager. The DevOps engineer needs to implement automatic rotation without modifying the application code. Which solution should be used?
⚠ Common exam trap
Many exam-takers confuse AWS Secrets Manager's automatic rotation with a simple scheduled update of the secret value, or mistakenly believe that RDS or Parameter Store have built-in rotation capabilities, when in fact only Secrets Manager with a Lambda rotation function provides a fully automated, code-free solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Configure Secrets Manager to automatically rotate the secret every 30 days using a Lambda rotation function, and have the application retrieve the secret using the Secrets Manager API.
AWS Secrets Manager natively supports automatic rotation of secrets using a Lambda function that updates both the secret in Secrets Manager and the password in the RDS MySQL instance. This solution meets the 30-day rotation requirement without modifying application code, as the application retrieves the current secret via the Secrets Manager API, which automatically handles versioning and caching.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a scheduled job that runs every 30 days to update the secret in Secrets Manager with a new password.
Why it's wrong here
A scheduled job that simply calls UpdateSecret every 30 days is flawed because it changes the stored credential without updating the actual RDS database password. The database would continue accepting the old password, so the rotated secret value would be invalid. Secrets Manager rotation is not just a scheduled update; it requires a Lambda function that coordinates modifying the DB password and the secret in a single integrated flow.
- ✗
Store the credentials in AWS Systems Manager Parameter Store and configure automatic rotation using a Lambda function.
Why it's wrong here
AWS Systems Manager Parameter Store has no native rotation feature for RDS credentials, and the proposed solution would require you to build and manage a custom Lambda function to rotate the password. Parameter Store also lacks the staging labels (AWSCURRENT, AWSPENDING, etc.) and built-in integration with RDS that Secrets Manager provides for safe, automated rotation. Even with a Lambda function, Parameter Store does not automatically trigger rotation or manage the secret version lifecycle in a way that makes this a fully managed solution.
- ✗
Use the AWS RDS automatic password rotation feature, which automatically updates the password every 30 days.
Why it's wrong here
Amazon RDS does not provide a native 'automatic password rotation' feature that cycles the master password every 30 days on its own. RDS only supports manual password modification via the console, CLI, or API, or through the integrated rotation that Secrets Manager orchestrates. Therefore, selecting this option describes a nonexistent capability, and the correct approach is to use Secrets Manager's rotation configuration.
- ✓
Configure Secrets Manager to automatically rotate the secret every 30 days using a Lambda rotation function, and have the application retrieve the secret using the Secrets Manager API.
Why this is correct
Secrets Manager natively supports rotation for RDS credentials through a managed Lambda function. The rotation function updates the password in the RDS database and then stores the new value in the secret, using staging labels like AWSCURRENT and AWSPENDING to ensure applications can always retrieve valid credentials. The application retrieves the current secret via the Secrets Manager API (for example, GetSecretValue), and effective caching keeps this cost-efficient. This exactly meets the requirement of rotating the database every 30 days while keeping the application functional.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.