DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  The application caches the secret value and does not refresh it until the cache expires or the application is restarted.

  Why this is correct

  The application caches the secret value and does not refresh it until the cache expires or the application is restarted. This is the classic stale-secret problem: even though Secrets Manager's AWSCURRENT label points to the new version, the boto3 or AWS SDK client-side cache still holds the old value. The application will continue to use the previous database credentials until the cache TTL elapses or the process is restarted. This perfectly matches the symptom of a successful retrieval that still yields outdated credentials.

• ✗

  The secret is in a different AWS Region than the application.

  Why it's wrong here

  If the secret were in a different AWS Region than the EC2 application, any call to GetSecretValue would fail outright with a ResourceNotFoundException, because Secrets Manager secrets are regional resources. The application would not be able to retrieve any secret value at all, let alone a stale one. Since the engineer confirmed the application is actively getting a secret value, the region mismatch cannot be the root cause; the secret must be in the same region or the call would error before returning data.

• ✗

  The EC2 instance does not have permission to call secretsmanager:GetSecretValue.

  Why it's wrong here

  A missing secretsmanager:GetSecretValue permission on the instance's IAM role would cause an AccessDeniedException, not the return of an outdated secret. The application would fail to fetch any secret, so it could never authenticate with old credentials. The engineer explicitly verified that the IAM policy allows the desired action, eliminating this as a cause. Moreover, stale-secret symptoms point to caching behavior, not to authorization failures.

• ✗

  The rotation Lambda function is not updating the secret version label to AWSCURRENT.

  Why it's wrong here

  If the rotation Lambda function were failing to update the AWSCURRENT version label, then calls to GetSecretValue would still return the previous secret—but the engineer confirmed the new version is indeed marked AWSCURRENT. When AWSCURRENT is correct, any fresh, uncached request would return the rotated value. Since the application receives the correct AWSCURRENT secret on API calls but still uses old credentials, the label update is not the issue. The only remaining explanation is client-side caching.

Go deeper

Related to this question