DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Use AWS KMS to generate and rotate a data key for encrypting the credentials in a file on ECS.

  Why it's wrong here

  AWS KMS is a key management service that creates and controls encryption keys, not rotating the underlying secret value. Using GenerateDataKey to encrypt a credential file on ECS protects the file at rest, but the database password itself remains unchanged and must be rotated manually or through a separate process. Envelope encryption with a KMS data key does not address the requirement for automatic credential rotation; it only addresses encryption of stored data.

• ✗

  Store the credentials in AWS Systems Manager Parameter Store as a SecureString. Use a Lambda function to rotate them.

  Why it's wrong here

  SSM Parameter Store can store credentials as a SecureString using KMS encryption, but it has no native rotation capability. You could create a custom Lambda function to generate a new password and update both the parameter and the database, but that requires you to build and operate the entire rotation workflow, including scheduling and error handling. AWS Secrets Manager is the managed service designed for this exact use case, so this option puts unnecessary operational burden on the engineer and does not provide built-in automatic rotation.

• ✓

  Store the credentials in AWS Secrets Manager and configure rotation. Grant the ECS task IAM role permission to retrieve the secret.

  Why this is correct

  AWS Secrets Manager natively supports automatic rotation of secrets with a configurable rotation schedule, using a Lambda function that updates the secret in both Secrets Manager and the target database. The ECS task assumes an IAM role whose permissions include secretsmanager:GetSecretValue, allowing the container to fetch the current password at runtime without embedding it in the task definition. This approach centralizes secret storage, enables rotation without redeploying the ECS service, and follows AWS best practices for managing database credentials.

• ✗

  Use AWS Certificate Manager to store the credentials as a certificate.

  Why it's wrong here

  AWS Certificate Manager is specifically designed to provision, manage, and deploy public and private X.509 TLS certificates used to encrypt network traffic. It cannot store arbitrary database credentials or any other key-value secrets, nor does it have a mechanism to rotate database passwords. Using ACM for this purpose is a fundamental misuse of the service, as it provides no API to retrieve a secret value for an application to use as a database password.

Go deeper

Related to this question

Same concept, more angles

2 more ways this is tested on DOP-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.