DOP-C02 Security and Compliance Practice Question
A DevOps engineer needs to securely store and automatically rotate database credentials for a MySQL RDS instance. The credentials should be accessible to a Lambda function without hardcoding them. Which AWS service should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is the correct service because it allows you to store secrets, automatically rotate them for supported RDS databases, and retrieve them programmatically via the Lambda runtime using the Secrets Manager API. AWS Systems Manager Parameter Store can store secrets but does not natively support automatic rotation for RDS. AWS KMS is used for managing encryption keys, not storing secrets. IAM roles for EC2 provide permissions to EC2 instances but cannot store credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store can store secrets as SecureString parameters, but it offers no built-in automatic rotation for RDS database credentials. You would have to build custom Lambda rotation functions and manage rotation schedules yourself, which is operationally heavy and error-prone. Parameter Store also lacks Secrets Manager's native integration with RDS and per-secret access control policies, making it a less suitable choice for this requirement.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is purpose-built for storing, retrieving, and automatically rotating database credentials. It provides native integration with RDS, allowing you to configure automatic rotation on a schedule with a managed Lambda rotation function that updates credentials in both Secrets Manager and RDS. Fine-grained IAM policies can restrict access to specific secrets, and the service also supports cross-account access, making it the correct answer for securely storing and auto-rotating RDS credentials.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
AWS Key Management Service (KMS) is designed to manage the encryption keys that protect data, not to store secrets like database credentials. KMS performs cryptographic operations such as encrypting and decrypting data using envelope encryption, but it does not hold plaintext secrets or offer rotation for RDS passwords. You could use KMS to encrypt a secret stored in another service, but KMS itself cannot serve as the secret store required here.
- ✗
IAM roles for EC2
Why it's wrong here
IAM roles attached to EC2 instances provide temporary AWS API credentials via instance metadata, but they do not store or rotate database credentials. While IAM database authentication for RDS can let an application use a temporary token instead of a static password, it still requires initial secret material or a separate secure configuration and does not offer automatic rotation of database accounts. IAM roles fundamentally address API-level access, not the storage or lifecycle of RDS credentials.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 1,298 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.