DOP-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Systems Manager Parameter Store

  Why this is correct

  AWS Systems Manager Parameter Store is a central, hierarchical store for configuration data and secrets. It supports SecureString parameters encrypted with AWS KMS, and it can be used to store database credentials or API keys. While Parameter Store does not provide native rotation, you can build a scheduled AWS Lambda function triggered by EventBridge to update the parameter value, thereby managing and rotating secrets on a schedule.

• ✓

  AWS Secrets Manager

  Why this is correct

  AWS Secrets Manager is a purpose-built service for managing the full lifecycle of secrets, including database credentials. It includes native automatic rotation using Lambda functions that Secrets Manager configures for supported databases such as RDS, Redshift, and DocumentDB, with optional custom rotation. It also provides fine-grained access control, automatic generation of random secrets, and runtime retrieval, making it a direct answer for managing and rotating secrets.

• ✗

  AWS CloudFormation

  Why it's wrong here

  AWS CloudFormation is an infrastructure-as-code provisioning engine that creates and updates AWS resources from templates. It does not manage or rotate application credentials; at most, it can reference secrets stored elsewhere via dynamic references such as `{{resolve:secretsmanager:...}}` in resource properties. Since it has no scheduling or credential lifecycle mechanism, it is wrong for this task.

• ✗

  AWS KMS

  Why it's wrong here

  AWS KMS is a key management service that creates and controls KMS keys and performs encryption and decryption operations. It supports automatic rotation of the key material for KMS keys, but that rotates the encryption key, not the actual secret value such as a database password. Storing credentials and rotating those secrets is outside KMS's scope, so it cannot serve as a standalone secret management and rotation service.

• ✗

  AWS IAM

  Why it's wrong here

  AWS IAM governs identities for AWS API access, including users, roles, groups, and policies, and supports rotating IAM user access keys for programmatic access. It does not manage application-defined secrets like database passwords, and its access keys are separate from credentials used by applications. Since the question asks about data credential management and rotation, IAM is not one of the correct services.

Go deeper

Related to this question