DOP-C02 Security and Compliance Practice Question
A DevOps engineer needs to securely store database credentials for an application running on EC2. The credentials must be rotated automatically every 30 days. Which solution meets these requirements?
⚠ Common exam trap
It's easy for candidates to confuse AWS Systems Manager Parameter Store's ability to store secrets (with SecureString) with the automatic rotation capability, but Parameter Store lacks built-in rotation scheduling and requires custom Lambda code, making Secrets Manager the only fully managed solution for automatic credential rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use AWS Secrets Manager to store the credentials and configure automatic rotation with the RDS rotation Lambda blueprint.
AWS Secrets Manager is the correct choice because it is purpose-built for securely storing, managing, and automatically rotating database credentials. It provides a built-in RDS rotation Lambda blueprint that can be configured to rotate credentials every 30 days without custom code. This fully managed rotation capability meets the requirement for automatic, scheduled rotation with minimal operational overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use AWS Secrets Manager to store the credentials and configure automatic rotation with the RDS rotation Lambda blueprint.
Why this is correct
AWS Secrets Manager is designed for managing database credentials and provides native automatic rotation. Its RDS rotation Lambda blueprint creates a Lambda function that updates the secret and the database user password on a defined schedule, without application changes. The service also tracks secret versions and supports KMS encryption, making it the secure, fully managed choice for this requirement.
- ✗
Store credentials in AWS Systems Manager Parameter Store and use a Lambda function to rotate them.
Why it's wrong here
Parameter Store can store database credentials as SecureString values encrypted with KMS, but it has no native rotation capability. Building rotation with a custom Lambda requires you to write and maintain code that updates both the database password and the parameter value, and you must manage versioning and error handling yourself. Secrets Manager provides the RDS rotation Lambda blueprint out of the box, so this option is unnecessarily complex and not fully managed.
- ✗
Store credentials in an S3 bucket encrypted with KMS and use S3 Lifecycle policies to rotate the objects.
Why it's wrong here
S3 Lifecycle policies are designed to transition objects between storage classes or expire them after a period, not to rotate credentials. In an S3-based approach, an object containing a secret does not change the actual password in the database; the application would still need custom logic to fetch a new object and apply it, and nothing in S3 updates the RDS user. Using S3 as a secret store also spreads sensitive data outside a dedicated secrets manager, complicating access control and audit compared to Secrets Manager.
- ✗
Use IAM roles to grant the EC2 instance access to the database, eliminating the need for credentials.
Why it's wrong here
IAM roles grant applications temporary AWS credentials for calling AWS APIs, but they are not database credentials. For RDS, IAM database authentication is only supported for specific engines such as MySQL and PostgreSQL, and even then the database must still have a corresponding database user and the application must generate a short-lived authentication token, so credentials are not truly eliminated. For many databases and arbitrary SQL engines, a username and password (or another native credential) is still required, making this option inapplicable to the general requirement.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 251 original DOP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on DOP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company wants to securely store database credentials used by an application running on Amazon EC2. The credentials should be automatically rotated every 90 days. Which AWS service should be used?
easy- A.AWS IAM
- B.AWS KMS
- C.AWS Systems Manager Parameter Store
- ✓ D.AWS Secrets Manager
Why D: AWS Secrets Manager is designed for securely storing secrets and provides automatic rotation. Systems Manager Parameter Store can store secrets but does not natively support rotation without custom automation. KMS is for encryption keys, not secret rotation.
Variation 2. A DevOps engineer needs to store database credentials for an application running on Amazon ECS. The credentials must be automatically rotated every 30 days and encrypted at rest. Which solution meets these requirements with the LEAST operational overhead?
medium- A.Store credentials in AWS Systems Manager Parameter Store as SecureString.
- B.Encrypt credentials with AWS KMS and store them in a versioned S3 bucket.
- C.Embed credentials as environment variables in the ECS task definition.
- ✓ D.Store credentials in AWS Secrets Manager and configure automatic rotation.
Why D: AWS Secrets Manager provides built-in automatic rotation and encryption at rest using AWS KMS. Option D meets the requirements with the least operational overhead. Option A is incorrect because Parameter Store (SecureString) does not support automatic rotation natively. Option B requires custom rotation logic and management. Option C embeds credentials insecurely in environment variables without rotation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.