DOP-C02 Configuration Management and IaC Practice Question
A DevOps engineer is using AWS Systems Manager Parameter Store to manage configuration data for a fleet of Amazon EC2 instances. The engineer needs to store a database password that must be encrypted at rest and audited for access. The password should be automatically rotated every 30 days. Which solution meets these requirements?
⚠ Common exam trap
The trap here is assuming that Parameter Store SecureString parameters support automatic rotation, which they do not; rotation must be implemented manually.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the password in AWS Secrets Manager and configure automatic rotation using a Lambda rotation function.
AWS Secrets Manager is purpose-built for managing secrets like database passwords. It encrypts secrets using KMS, logs access via CloudTrail, and supports automatic rotation through Lambda functions. Parameter Store SecureString parameters offer encryption but lack built-in rotation. Therefore, Secrets Manager is the correct choice for meeting all requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store the password as a String parameter in Parameter Store and enable AWS CloudTrail logging.
Why it's wrong here
String parameters are not encrypted; they are stored in plaintext. Even with CloudTrail logging, the password would be visible in the Parameter Store console and API responses. This option fails the encryption requirement and does not support rotation, making it insecure and non-compliant.
- ✗
Store the password as a SecureString parameter in Parameter Store with the default AWS managed KMS key.
Why it's wrong here
SecureString parameters are encrypted with AWS KMS, but they do not support automatic rotation. You would need to manually update the parameter value. Additionally, using the default AWS managed key does not provide fine-grained access control or auditing of key usage. This option lacks the required rotation feature.
- ✓
Store the password in AWS Secrets Manager and configure automatic rotation using a Lambda rotation function.
Why this is correct
AWS Secrets Manager is designed for storing and rotating secrets. It supports automatic rotation via Lambda functions, and it integrates with AWS KMS for encryption and AWS CloudTrail for auditing. This solution meets all requirements: encryption at rest, auditing, and automatic 30-day rotation.
- ✗
Store the password in an encrypted Amazon S3 object and use S3 bucket policies to restrict access.
Why it's wrong here
S3 can encrypt data at rest, but it does not provide automatic rotation or fine-grained auditing of secret access. You would have to implement rotation manually, and auditing would rely on S3 access logs, which are not as detailed as CloudTrail for secret access. This approach is not purpose-built for secrets management.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every DOP-C02 question from scratch — 1,298 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.