DOP-C02 Configuration Management and IaC Practice Question
A company uses AWS CloudFormation to deploy a complex application that includes an Amazon RDS database. The database must be created with a specific master password that is stored in AWS Secrets Manager. The DevOps team wants to avoid hardcoding the password in the CloudFormation template. They need to reference the secret in the template so that the RDS instance uses the password from Secrets Manager. Which approach should they take?
⚠ Common exam trap
A common mix-up: candidates confuse the dynamic reference for Systems Manager Parameter Store (`resolve:ssm-secure`) with the one for Secrets Manager (`resolve:secretsmanager`).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the `resolve:secretsmanager` dynamic reference to retrieve the secret value and assign it to the RDS `MasterUserPassword` property.
The `resolve:secretsmanager` dynamic reference allows CloudFormation to retrieve a secret from AWS Secrets Manager during stack operations. This enables secure injection of the secret into the RDS `MasterUserPassword` property without hardcoding. Other options either use the wrong service (Parameter Store) or introduce unnecessary complexity with custom resources or insecure storage.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the secret in an Amazon S3 bucket and use the `Fn::GetAtt` function to reference it in the RDS `MasterUserPassword` property.
Why it's wrong here
`Fn::GetAtt` retrieves attributes from resources within the same CloudFormation stack, not from S3 objects. It cannot fetch a secret from an S3 bucket. Additionally, storing secrets in S3 is less secure than Secrets Manager. This approach would not work and does not meet the requirement to use Secrets Manager. The correct method is the `resolve:secretsmanager` dynamic reference.
- ✗
Use the `resolve:ssm-secure` dynamic reference to retrieve the secret from Secrets Manager and pass it to the RDS `MasterUserPassword` property.
Why it's wrong here
`resolve:ssm-secure` is a dynamic reference for AWS Systems Manager Parameter Store SecureString parameters, not for Secrets Manager secrets. It cannot retrieve secrets from Secrets Manager. Using it would result in an error or incorrect value. The correct dynamic reference for Secrets Manager is `resolve:secretsmanager`, making this option incorrect for the scenario.
- ✓
Use the `resolve:secretsmanager` dynamic reference to retrieve the secret value and assign it to the RDS `MasterUserPassword` property.
Why this is correct
CloudFormation supports the `resolve:secretsmanager` dynamic reference to fetch secret values from AWS Secrets Manager during stack operations. This allows the RDS instance to use the secret without hardcoding it. The dynamic reference retrieves the secret at deployment time, and CloudFormation manages the value securely. This is the correct and secure approach for referencing Secrets Manager secrets in templates.
- ✗
Create a custom CloudFormation resource using AWS Lambda that retrieves the secret from Secrets Manager and returns it to the template.
Why it's wrong here
While a custom resource can retrieve secrets, it adds unnecessary complexity and development effort. The Lambda function must be written, deployed, and maintained, and it introduces potential security risks if not properly secured. CloudFormation's native dynamic reference is simpler and more secure, eliminating the need for custom code. Therefore, this approach is not recommended.
Visual reference
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.