SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  AWS Secrets Manager with rotation enabled

  Why this is correct

  AWS Secrets Manager is the only option that provides a purpose-built, managed secret lifecycle with automatic rotation. Rotation is implemented by a custom or AWS-provided Lambda function that updates the secret value in the store and in the target database or service, ensuring credentials are periodically changed without application downtime. The service also supports fine-grained access policies, versioning during rotation, and native integration with Amazon RDS, Redshift, and other AWS services, so it is the optimal choice for an order-processing API that must rotate credentials automatically.

• ✗

  An encrypted object in Amazon S3

  Why it's wrong here

  Storing the API credential as an encrypted object in Amazon S3 would provide encryption at rest, but S3 is a general-purpose object store, not a secret management service. There is no built-in rotation mechanism for the secret value itself; you would need to build custom logic to retrieve, update, and rotate the object, including handling versioning and access control. While SSE-KMS or client-side encryption can protect the object, the lack of managed rotation and secret lifecycle features makes this a poor fit for a production order-processing API.

• ✗

  AWS Systems Manager Parameter Store SecureString without automation

  Why it's wrong here

  AWS Systems Manager Parameter Store can store a secret as a SecureString encrypted with a KMS key, which is more straightforward than S3 for configuration data. However, Standard and Advanced tiers provide no built-in rotation for a SecureString's value; rotation requires you to implement an external automation such as a state machine or a scheduled custom process to call PutParameter with a new value. Without that automation, the secret would remain static indefinitely, failing the requirement for automatic rotation. Even with the ability to tag and version parameters, SecureString without automation does not meet the 'rotation enabled' criterion.

• ✗

  A KMS-encrypted Lambda environment variable

  Why it's wrong here

  A KMS-encrypted Lambda environment variable protects the secret at rest by encrypting it with a customer-managed key during deployment. However, the decrypted value is simply exposed to the function via process.env, and Lambda provides no mechanism to automatically rotate that value when the secret changes. Rotating the KMS key itself does not alter the secret value; it only re-encrypts the environment variable, so the credential stays static. Additionally, the environment variable is visible in plaintext in the Lambda console by default (unless you disable that) and is stored per-function, so it lacks the centralized secret lifecycle management that Secrets Manager offers.

Go deeper

Related to this question