DOP-C02 Security and Compliance Practice Question
A company uses AWS Secrets Manager to store database credentials. The security team needs to automatically rotate the secrets every 30 days. Which action should be taken?
⚠ Common exam trap
DOP-C02 often tests the confusion between secret rotation and KMS key rotation, tricking candidates into selecting KMS when the requirement is to rotate the secret value itself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic rotation on the secret and configure the rotation interval to 30 days
AWS Secrets Manager supports automatic rotation of secrets using a Lambda rotation function. By enabling automatic rotation and setting the rotation interval to 30 days, the secret is rotated automatically without manual intervention. This meets the security team's requirement for automatic rotation every 30 days.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Enable automatic rotation on the secret and configure the rotation interval to 30 days
Why this is correct
Secrets Manager natively supports automatic rotation by invoking a configurable Lambda function that updates both the database credential and the secret value. Setting the rotation interval to 30 days on the secret ensures the database password is rotated without any manual intervention or custom infrastructure. The rotation Lambda must have permission to modify the database and call the UpdateSecret API, and the interval can be adjusted to meet compliance requirements.
- ✗
Manually rotate the secret every 30 days using the AWS Management Console
Why it's wrong here
Manually rotating the secret via the AWS Management Console requires an operator to generate a new password, update the database, and then edit the secret's value. This process is error-prone, leaves no automated audit trail, and does not scale; it also fails to leverage Secrets Manager's built-in rotation capability that is designed precisely to eliminate manual steps. Since the requirement implies an automated and reliable rotation policy, manual rotation does not satisfy it.
- ✗
Store the secret in AWS Systems Manager Parameter Store and use a scheduled Lambda to update it
Why it's wrong here
While Systems Manager Parameter Store can hold secrets, it has no native rotation functionality; you would have to build a scheduled Lambda script entirely from scratch to update both the parameter and the database. This custom solution is more complex than using Secrets Manager's managed rotation, introduces extra IAM roles, triggers, and monitoring, and lacks the built-in integration with the rotation Lambda that Secrets Manager provides. Even though it could technically rotate a secret, it is not the intended or most reliable way to meet the 30-day rotation requirement.
- ✗
Use AWS KMS to rotate the secret by re-encrypting with a new key
Why it's wrong here
AWS KMS rotates the Customer Master Key (CMK) used to encrypt a secret, but it never changes the secret's contents, such as the database password. Re-encrypting the same secret with a new key only changes the ciphertext, not the credential string, so the database password remains identical and the rotation policy is not fulfilled. KMS key rotation is a cryptographic control, not a secret rotation mechanism, and it does not notify the database or application of any new password.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.