DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  The Lambda function's execution role lacks the required IAM permissions.

  Why it's wrong here

  A lack of IAM permissions typically causes an `AccessDenied` error, not a timeout. The Lambda function would fail quickly when attempting an unauthorised action, rather than executing for too long and then timing out. This option is tempting because insufficient permissions are a very common cause of Lambda failures when interacting with AWS services like Secrets Manager or RDS. It would be correct if the function failed with an `AccessDeniedException` when trying to update credentials or access the database.

• ✓

  The Lambda function is not configured to access the VPC where the RDS instance resides.

  Why this is correct

  For the rotation function to update credentials on RDS, it must be deployed inside the same VPC or have a route to it; if the Lambda function lacks VPC configuration, its ENI never gets a private IP in the RDS subnet. Each invocation then tries to open a socket to the database but has no network path, so it consumes the entire configured timeout and Secrets Manager reports rotation as failed. Merely granting IAM permissions for secretsmanager and RDS does not create network connectivity, so this is the root cause when the error is consistently a timeout rather than an access-denied.

• ✗

  The secret rotation schedule is set to less than 24 hours.

  Why it's wrong here

  The rotation schedule only tells CloudWatch Events how often to invoke the Lambda function, not how many seconds the function is allowed to run. Lambda's own timeout is set independently of the rotation frequency and has an absolute maximum of 15 minutes, so shortening the schedule to every 24 hours cannot make an individual invocation run longer. A slow DB connection would still time out with the same error whether rotation happens daily, weekly, or every 8 hours, making the schedule irrelevant to the observed symptom.

• ✗

  The Lambda function does not have permission to access the S3 bucket.

  Why it's wrong here

  Secrets Manager's rotation process never stores, reads, or stages anything in an S3 bucket, so the function's IAM policy needs no S3 permissions at all. The Lambda role instead requires actions such as secretsmanager:DescribeSecret, secretsmanager:GetSecretValue, and RDS/DB connection privileges, and a missing S3 permission would not prevent network traffic to the database. In fact, if S3 permissions were absent, no S3 call would ever be attempted, so the failure would still present as a timeout due to the unrelated networking problem.

Go deeper

Related to this question