SAA-C03 Design Secure Architectures Practice Question
A company is migrating a legacy application to AWS. The application uses a fixed set of credentials stored in a configuration file to access an Amazon RDS database. The security team wants to eliminate hardcoded credentials and automatically rotate them every 30 days. The application runs on Amazon EC2 instances and can be modified to retrieve credentials at startup. Which solution meets these requirements with the LEAST operational overhead?
⚠ Common exam trap
The trap here is assuming that Parameter Store provides automatic rotation; it does not, and you must implement it yourself.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the credentials in AWS Secrets Manager and configure automatic rotation every 30 days. Modify the application to retrieve the secret using the AWS SDK.
AWS Secrets Manager is designed for this use case: it stores and automatically rotates database credentials using a Lambda rotation function, with minimal setup. The application retrieves the secret via the AWS SDK, eliminating hardcoded credentials. Other options lack built-in rotation or require custom development, increasing operational overhead.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the credentials in AWS Secrets Manager and configure automatic rotation every 30 days. Modify the application to retrieve the secret using the AWS SDK.
Why this is correct
AWS Secrets Manager natively supports automatic rotation for Amazon RDS databases by using a Lambda rotation function. It eliminates hardcoded credentials and integrates with IAM for access control. Modifying the application to retrieve the secret at startup is a one-time change, and rotation is managed by the service, minimizing operational overhead.
- ✗
Store the credentials in an encrypted Amazon S3 object and use S3 Object Lambda to decrypt them at runtime. Configure a lifecycle policy to delete and recreate the object every 30 days.
Why it's wrong here
This approach is complex and does not provide true credential rotation. Deleting and recreating the object would require generating new credentials and updating the database, which is not automated. It also introduces unnecessary components and does not integrate with RDS for rotation, leading to high operational overhead.
- ✗
Use AWS KMS to encrypt the credentials and store them in an EC2 instance's user data. Use an AWS Lambda function to rotate the credentials and update the user data every 30 days.
Why it's wrong here
User data is not a secure location for credentials; it is accessible to anyone with EC2 permissions and is not encrypted by default. While KMS can encrypt the data, storing it in user data is not a best practice. Additionally, updating user data requires stopping and starting the instance, causing downtime and high operational overhead.
- ✗
Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter and write a custom Lambda function to rotate them every 30 days.
Why it's wrong here
Parameter Store SecureString encrypts the parameter, but it does not provide built-in rotation. You would need to develop and maintain a custom rotation Lambda function, which increases operational overhead. Secrets Manager offers managed rotation out of the box, making it a better fit for the requirement.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAA-C03 question from scratch — 935 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.