SAA-C03 Design Secure Architectures Practice Question
A Lambda function for a mobile banking backend needs to read a database password. The password must rotate automatically every 30 days and should not be stored in environment variables. Which service should be used?
⚠ Common exam trap
Many candidates confuse AWS Systems Manager Parameter Store SecureString with Secrets Manager, but Parameter Store does not support automatic rotation without custom automation, making it unsuitable for a 30-day rotation requirement.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager with rotation enabled
AWS Secrets Manager is the correct choice because it provides built-in automatic rotation of secrets (e.g., database passwords) with a configurable rotation interval (e.g., 30 days). It integrates natively with AWS Lambda via the AWS SDK, allowing the function to retrieve the password at runtime without storing it in environment variables. Secrets Manager also encrypts secrets at rest using KMS and supports automatic rotation via a Lambda rotation function, meeting both the security and rotation requirements.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
An encrypted object in Amazon S3
Why it's wrong here
Amazon S3 can encrypt objects at rest using SSE-KMS, but it is fundamentally a storage service, not a secrets lifecycle manager. Storing a database password as an encrypted object forces you to manually manage fetching, decrypting, and updating the secret in your mobile banking backend code. S3 lacks native scheduling for secret rotation, automatic propagation of new values, or secret-specific auditing, so it fails to meet a requirement for managed, recurring rotation.
- ✓
AWS Secrets Manager with rotation enabled
Why this is correct
AWS Secrets Manager is a purpose-built service for storing and managing secrets such as database credentials, and with rotation enabled it automatically updates the secret on a defined schedule using a Lambda-based rotation function. It encrypts secrets with KMS keys, integrates directly with services like RDS and Lambda, and provides a caching layer to reduce latency and cost for high-frequency reads. This makes it the correct choice for a mobile banking backend that must rotate credentials regularly without custom orchestration.
- ✗
AWS Systems Manager Parameter Store SecureString without automation
Why it's wrong here
AWS Systems Manager Parameter Store SecureString parameters are encrypted with KMS and can hold secrets, but the service does not provide built-in, scheduled rotation for the secret value. Without automation, you must build your own Lambda functions or scripts to periodically change the secret and then update the consumes, such as the mobile banking backend, which adds operational overhead and risk of missed rotations. Parameter Store is a lightweight alternative, but the lack of managed rotation makes it unsuitable for this compliance-driven requirement.
- ✗
A KMS-encrypted Lambda environment variable
Why it's wrong here
Encrypting a Lambda environment variable with KMS protects the secret at rest in the function configuration, but it remains a static value that is decrypted only at runtime. There is no managed rotation: changing the secret requires manual redeployment of the function, and the secret is not tracked or versioned as part of a lifecycle. Additionally, the plaintext can be exposed via function configuration access or KMS decrypt permissions, so an encrypted environment variable is not an adequate replacement for a service that provides automatic rotation and centralized secret management.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 935 original SAA-C03 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.