SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Secrets Manager with rotation enabled

  Why this is correct

  AWS Secrets Manager is purpose-built for storing and retrieving secrets at runtime, and the rotation-enabled configuration automatically rotates database credentials on a schedule using an accompanying AWS Lambda function. This ensures the Lambda function always reads a valid, current secret without manual intervention, and access can be scoped via IAM policies. It also integrates with CloudTrail for auditing secret access, making it the appropriate choice for a production IoT ingestion pipeline.

• ✗

  A KMS-encrypted Lambda environment variable

  Why it's wrong here

  Encrypting a Lambda environment variable with a KMS key protects the secret at rest and in transit, but the plaintext value is still embedded in the function configuration and can be retrieved by anyone with `lambda:GetFunctionConfiguration` or `lambda:GetEnvironmentVariables` permissions. Since the value is static, there is no automatic rotation; when the credential changes you must redeploy the function or manually update the configuration, and the old secret remains visible in configuration history. This approach is therefore operationally brittle and does not satisfy a secret lifecycle management requirement.

• ✗

  AWS Systems Manager Parameter Store SecureString without automation

  Why it's wrong here

  AWS Systems Manager Parameter Store's SecureString parameter is encrypted with a KMS key, but this service does not automatically rotate the secret value; rotation requires you to build a separate automation or Lambda function to update the parameter on a schedule. Parameter Store also lacks native integration with database services for automatic user/credential rotation, so the secret can become stale. While Parameter Store is a valid secret store, 'without automation' fails the need for managed, scheduled rotation that Secrets Manager provides.

• ✗

  An encrypted object in Amazon S3

  Why it's wrong here

  An encrypted object in Amazon S3 uses SSE-KMS to protect data at rest, but S3 is just an object store—it has no concept of secret generation, rotation, or lifecycle management for credentials. To rotate a secret stored this way, you would have to upload a new object, then update every consuming Lambda function's reference to the new object key or rely on bucket versioning, which still requires external orchestration. Additionally, IAM permission management for object access is coarser than Secrets Manager's resource-based policies, and there is no audit trail tied to secret retrieval.

Go deeper

Related to this question