DOP-C02 Security and Compliance Practice Question
A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service can be used to achieve this?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Config with a custom Lambda function to rotate keys when they are older than 90 days.
AWS IAM does not have a built-in automatic rotation feature for access keys. AWS Secrets Manager can store secrets and rotate them, but it does not natively rotate IAM access keys; it supports rotation for RDS, Redshift, and DocumentDB, but not IAM. AWS CloudTrail is a logging service and cannot rotate keys. However, AWS Config can be used with a custom AWS Lambda function to create a rule that triggers rotation when access keys are older than 90 days. Therefore, option D is the correct answer.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the access keys in AWS Secrets Manager and enable automatic rotation.
Why it's wrong here
AWS Secrets Manager's automatic rotation does not natively support IAM user access keys. Its built-in rotation templates only cover database credentials for services like Amazon RDS, Redshift, and DocumentDB; for IAM keys you'd still need a custom Lambda rotation function that calls IAM APIs. Simply storing the keys in Secrets Manager and enabling rotation would fail because the service has no native knowledge of how to create, deactivate, or delete IAM access keys, and it also cannot update downstream applications using those keys.
- ✗
Use AWS CloudTrail to detect old keys and send notifications to administrators.
Why it's wrong here
CloudTrail is an audit trail that records API calls such as CreateAccessKey or GetAccessKeyLastUsed, but it does not maintain a stateful inventory of IAM resources and cannot evaluate the current age or rotation status of an access key. It also has no built-in mechanism to initiate rotation actions; even if you attempted to build notifications based on CloudTrail events, you would need separate automation to actually rotate the keys. Therefore, CloudTrail alone cannot detect keys older than 90 days or take the necessary IAM actions to replace them.
- ✗
Use IAM's built-in access key rotation feature.
Why it's wrong here
IAM does not provide any built-in automatic access key rotation feature. The IAM console and API offer only manual lifecycle operations—creating new keys, making existing keys active or inactive, and deleting keys—and there is no scheduler, policy, or configuration that can automatically rotate keys at a defined interval. You can use IAM policy conditions to require recent keys, but that only enforces manual rotation and is not an automatic rotation mechanism.
- ✓
Use AWS Config with a custom Lambda function to rotate keys when they are older than 90 days.
Why this is correct
AWS Config enables this by hosting a custom rule that invokes a Lambda function on a schedule using the rule's 'maximum execution frequency' setting, evaluating all IAM users' access keys for age. The Lambda function can use IAM API calls such as ListAccessKeys and GetAccessKeyLastUsed to identify keys older than 90 days, then rotate them by creating a new access key, deactivating the old key, and deleting the old key after a grace period. This is a well-known pattern because AWS Config provides the periodic orchestration and compliance evaluation while Lambda handles the actual IAM operations.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,013 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to automate the rotation of IAM user access keys every 90 days. Which AWS service should be used to implement this rotation?
medium- ✓ A.AWS Lambda with custom rotation logic
- B.AWS Config
- C.AWS Secrets Manager
- D.AWS Systems Manager Parameter Store
Why A: AWS Lambda with custom rotation logic is the correct service to automate IAM user access key rotation because AWS does not provide a native service that automatically rotates IAM access keys. AWS Secrets Manager can rotate secrets for databases and other services, but it does not support rotating IAM user access keys. Therefore, the recommended approach is to implement a custom Lambda function that generates new keys, updates the user, and manages the rotation lifecycle. Option B (AWS Config) only monitors compliance, not credentials. Option D (Systems Manager Parameter Store) stores secrets but lacks rotation capabilities for IAM keys.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.