DOP-C02 Security and Compliance Practice Question
A DevOps engineer needs to securely store database credentials for an application running on Amazon ECS. Which AWS service should be used to manage the credentials and provide them to the ECS tasks?
⚠ Common exam trap
DOP-C02 often tests the distinction between Secrets Manager and Parameter Store — candidates pick Parameter Store for database credentials, but Secrets Manager is preferred when automatic rotation and native secret management are required.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is purpose-built for storing, rotating, and retrieving secrets such as database credentials, and it integrates natively with ECS so tasks can inject secrets as environment variables or in log configuration. It supports automatic rotation via Lambda, which is ideal for database credentials. ECS task definitions reference Secrets Manager secrets using the secrets block with valueFrom.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
AWS Secrets Manager
Why this is correct
AWS Secrets Manager is the correct choice because it is a purpose-built service for securely storing and managing database credentials, API keys, and other secrets. It provides native automatic rotation of database credentials via Lambda, fine-grained IAM-based access control, and built-in audit integration with AWS CloudTrail and Amazon EventBridge. Unlike generic storage services, Secrets Manager caches secrets securely and enforces resource-based policies, making it the only fully managed solution that directly addresses the requirements.
- ✗
Amazon S3 with server-side encryption
Why it's wrong here
Amazon S3 with server-side encryption can store database credentials as encrypted objects and provides solid access controls through bucket policies and IAM, but it is not a dedicated secrets store. It lacks native secret rotation, so you must build a custom workflow to regularly change credentials. Additionally, S3 does not provide granular per-secret audit events that reference the secret name, and its management console is awkward for secret retrieval, making it a poor fit for environments requiring automated credential lifecycle management.
- ✗
AWS Systems Manager
Why it's wrong here
AWS Systems Manager is an umbrella service for operations management—covering patching, inventory, automation, and runbooks—rather than a purpose-built secrets store. While it does contain a Parameter Store feature, the Systems Manager service itself is not a recommendable place to store database credentials because it offers no direct secret-rotation capability and its access auditing is less comprehensive than a dedicated secrets manager. Using Systems Manager as a secret store also couples your security architecture with an operational tool, making least-privilege access management more complicated.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store (often just called SSM Parameter Store) can store credentials as SecureString parameters encrypted with KMS, and it is cheaper than Secrets Manager. However, it does not provide built-in automatic rotation of database credentials—you must orchestrate rotation yourself using Lambda and SDK calls. It also offers limited audit features: CloudTrail records API calls but there is no native per-secret rotation history, and no built-in secret versioning for rotation events. For automated credential lifecycle management, Secrets Manager provides these capabilities out of the box, which is why Parameter Store, while useful for configuration, is the second choice rather than the right answer.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This DOP-C02 question is part of Courseiva's 1,298-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.