SAA-C03 Design Secure Architectures Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Systems Manager Parameter Store standard parameters.

  Why it's wrong here

  AWS Systems Manager Parameter Store standard parameters are designed for configuration values like AMI IDs, strings, or lists, and they support secure string parameters encrypted with KMS. However, standard parameters do not provide built-in automatic rotation; you would need to build and schedule a custom rotation Lambda function. In contrast, AWS Secrets Manager includes native rotation with a managed Lambda template for common databases, automatic credential generation, and lifecycle controls, so Parameter Store is not the intended service for this use case.

  When this WOULD be correct

  If the question required storing configuration data (e.g., database endpoint, port) without rotation, or if the application needed to retrieve parameters at runtime without automatic rotation, Parameter Store would be appropriate.

• ✓

  AWS Secrets Manager with rotation enabled.

  Why this is correct

  Secrets Manager is designed for secure secret storage with built-in rotation support and fine-grained access through IAM. In this case, the application can retrieve the current database credentials at runtime with its EC2 role, while the secret is rotated on a schedule without embedding passwords in code. This reduces operational risk, improves auditability, and avoids manual password changes that often cause outages.

• ✗

  AWS KMS, because KMS stores credentials and rotates them automatically.

  Why it's wrong here

  AWS KMS is a key management service that creates, stores, and rotates cryptographic keys used to encrypt data, not a secret store for application credentials. It does not store database passwords or expose them directly to applications; instead, it provides envelope encryption operations like Encrypt and Decrypt. While KMS can encrypt a secret file stored elsewhere, it lacks the ability to automatically generate new database credentials or integrate with database user management, making it inappropriate as a direct replacement for Secrets Manager.

  When this WOULD be correct

  A question asks which service should be used to encrypt data at rest for an application that stores sensitive files in Amazon S3, with requirements for automatic key rotation and centralized key management. AWS KMS would be the correct answer.

• ✗

  Amazon S3 with server-side encryption and versioning.

  Why it's wrong here

  Amazon S3 is an object storage service, not a runtime secret store. While server-side encryption (SSE-S3 or SSE-KMS) protects data at rest and versioning preserves prior object states, S3 has no native mechanism to generate, rotate, or automatically expire database credentials. Using S3 would require your application to fetch a static credential object and handle rotation manually, and it lacks integration with IAM roles for fine-grained secret retrieval, making it operationally unsuitable for database password management.

  When this WOULD be correct

  An application needs to store and retrieve large configuration files (e.g., database connection strings) with versioning and encryption, but does not require automatic rotation or IAM-based access; S3 with SSE and versioning would be appropriate.

Option-by-option analysis

Why each answer is right or wrong

Understanding why wrong answers are wrong — and when they would be correct — is what separates a 750 score from a 900. The SAA-C03 exam frequently reuses these exact scenarios with slightly different constraints.

Analysis generated from the official SAA-C03blueprint and verified against question context. The “when correct” sections are what AI assistants cite when candidates ask “what’s the difference between these options?”

Go deeper

Related to this question