- A
Create a scheduled EventBridge rule to invoke a Lambda function that updates the Parameter Store SecureString value every 30 days
Why wrong: This works but requires custom development and lacks native rotation history. Secrets Manager provides this functionality without custom code.
- B
Migrate the credentials to AWS Secrets Manager and enable automatic rotation with a 30-day schedule
Secrets Manager provides native automatic rotation for RDS with a managed Lambda function. This meets the requirement with minimal operational overhead.
- C
Enable Parameter Store SecureString automatic rotation in the AWS console
Why wrong: Automatic rotation is not a built-in feature of Parameter Store. This option does not exist. Rotation must be implemented with custom Lambda code.
- D
Configure AWS Config to detect password age and trigger an SNS notification after 30 days
Why wrong: AWS Config detects compliance issues but cannot rotate credentials. SNS is a notification service — it cannot generate or update passwords.
Quick Answer
The answer is to migrate the credentials to AWS Secrets Manager and enable automatic rotation with a 30-day schedule. This is correct because AWS Secrets Manager natively supports automatic RDS password rotation using a managed Lambda function that updates both the database password and the secret atomically on a defined schedule, whereas Systems Manager Parameter Store SecureString lacks built-in rotation capabilities and requires custom automation. On the SAA-C03 exam, this scenario tests your understanding of the key difference between Parameter Store for configuration data and Secrets Manager for secrets requiring lifecycle management, with a common trap being that SecureString parameters can store secrets but cannot rotate them automatically. A helpful memory tip is “Secrets Manager rotates, Parameter Store stores”—if the requirement includes automatic rotation, always choose Secrets Manager.
SAA-C03 Practice Question: AWS Secrets Manager provides native automatic…
This SAA-C03 practice question tests your understanding of design secure architectures. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: aWS Secrets Manager provides native automatic rotation for RDS credentials. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company stores RDS database credentials in AWS Systems Manager Parameter Store as SecureString parameters. The security team requires that database passwords rotate automatically every 30 days. Which change should a solutions architect recommend?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
Migrate the credentials to AWS Secrets Manager and enable automatic rotation with a 30-day schedule
AWS Secrets Manager provides native automatic rotation for RDS credentials using a managed Lambda function that rotates the secret on a defined schedule and updates the database password atomically. Parameter Store SecureString does not support built-in automatic rotation — rotation must be implemented manually with custom automation. Secrets Manager is specifically designed for secrets requiring lifecycle management including rotation, auditing, and fine-grained access control.
Key principle: AWS Secrets Manager provides native automatic rotation for RDS credentials
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a scheduled EventBridge rule to invoke a Lambda function that updates the Parameter Store SecureString value every 30 days
Why it's wrong here
This works but requires custom development and lacks native rotation history. Secrets Manager provides this functionality without custom code.
- ✓
Migrate the credentials to AWS Secrets Manager and enable automatic rotation with a 30-day schedule
Why this is correct
Secrets Manager provides native automatic rotation for RDS with a managed Lambda function. This meets the requirement with minimal operational overhead.
Related concept
AWS Secrets Manager provides native automatic rotation for RDS credentials
- ✗
Enable Parameter Store SecureString automatic rotation in the AWS console
Why it's wrong here
Automatic rotation is not a built-in feature of Parameter Store. This option does not exist. Rotation must be implemented with custom Lambda code.
- ✗
Configure AWS Config to detect password age and trigger an SNS notification after 30 days
Why it's wrong here
AWS Config detects compliance issues but cannot rotate credentials. SNS is a notification service — it cannot generate or update passwords.
Common exam traps
Common exam trap: answer the scenario, not the keyword
Both services encrypt values using KMS, which causes candidates to treat them as equivalent. Only Secrets Manager provides automatic rotation with managed Lambda integration and rotation history. Parameter Store is appropriate for configuration values and static secrets. Whenever automatic rotation is a security policy requirement, Secrets Manager is the answer.
Detailed technical explanation
How to think about this question
Secrets Manager vs Parameter Store comparison: - Automatic rotation: Secrets Manager YES (built-in for RDS, Redshift, DocumentDB) | Parameter Store NO (requires custom Lambda) - Rotation history: Secrets Manager YES | Parameter Store NO - Cost: Secrets Manager $0.40/secret/month + API calls | Parameter Store free tier (standard) - Cross-account resource policy: Secrets Manager YES | Parameter Store limited Rule: Use Secrets Manager when a secret must rotate or when audit history is required. Use Parameter Store for app configuration and non-rotating secrets.
KKey Concepts to Remember
- AWS Secrets Manager provides native automatic rotation for RDS credentials
- Parameter Store SecureString does not support automatic rotation without custom Lambda
- Secrets Manager deploys a managed Lambda that generates, updates DB password, and updates the secret atomically
- Both services use AWS KMS for encryption
- Secrets Manager costs $0.40/secret/month; Parameter Store has a free tier
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
AWS Secrets Manager provides native automatic rotation for RDS credentials
Real-world example
How this comes up in practice
A company's IT admin needs to give a contractor read-only access to production logs without sharing account credentials. Using role-based access control (RBAC) and temporary scoped permissions — not a permanent shared password — is the correct pattern. Questions like this test whether you can apply least-privilege access across cloud identity services.
What to study next
Got this wrong? Here's your next step.
Review aWS Secrets Manager provides native automatic rotation for RDS credentials, then practise related SAA-C03 questions on the same topic to reinforce the concept.
- →
Design Secure Architectures — study guide chapter
Learn the concepts, then practise the questions
- →
Design Secure Architectures practice questions
Targeted practice on this topic area only
- →
All SAA-C03 questions
1,040 questions across all exam domains
- →
SAA-C03 study guide
Full concept coverage aligned to exam objectives
- →
SAA-C03 practice test guide
How to use practice tests most effectively before exam day
Related practice questions
Related SAA-C03 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
Design Secure Architectures practice questions
Practise SAA-C03 questions linked to Design Secure Architectures.
Design Resilient Architectures practice questions
Practise SAA-C03 questions linked to Design Resilient Architectures.
Design High-Performing Architectures practice questions
Practise SAA-C03 questions linked to Design High-Performing Architectures.
Design Cost-Optimized Architectures practice questions
Practise SAA-C03 questions linked to Design Cost-Optimized Architectures.
SAA-C03 VPC practice questions
Practise SAA-C03 questions linked to SAA-C03 VPC.
SAA-C03 S3 lifecycle policy questions
Practise SAA-C03 questions linked to SAA-C03 S3 lifecycle policy questions.
SAA-C03 RDS Multi-AZ questions
Practise SAA-C03 questions linked to SAA-C03 RDS Multi-AZ questions.
SAA-C03 IAM policy practice questions
Practise SAA-C03 questions linked to SAA-C03 IAM policy.
SAA-C03 Route 53 failover questions
Practise SAA-C03 questions linked to SAA-C03 Route 53 failover questions.
SAA-C03 CloudFront practice questions
Practise SAA-C03 questions linked to SAA-C03 CloudFront.
SAA-C03 NAT gateway questions
Practise SAA-C03 questions linked to SAA-C03 NAT gateway questions.
SAA-C03 VPC endpoint questions
Practise SAA-C03 questions linked to SAA-C03 VPC endpoint questions.
Practice this exam
Start a free SAA-C03 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SAA-C03 question test?
Design Secure Architectures — This question tests Design Secure Architectures — AWS Secrets Manager provides native automatic rotation for RDS credentials.
What is the correct answer to this question?
The correct answer is: Migrate the credentials to AWS Secrets Manager and enable automatic rotation with a 30-day schedule — AWS Secrets Manager provides native automatic rotation for RDS credentials using a managed Lambda function that rotates the secret on a defined schedule and updates the database password atomically. Parameter Store SecureString does not support built-in automatic rotation — rotation must be implemented manually with custom automation. Secrets Manager is specifically designed for secrets requiring lifecycle management including rotation, auditing, and fine-grained access control.
What should I do if I get this SAA-C03 question wrong?
Review aWS Secrets Manager provides native automatic rotation for RDS credentials, then practise related SAA-C03 questions on the same topic to reinforce the concept.
What is the key concept behind this question?
AWS Secrets Manager provides native automatic rotation for RDS credentials
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Keep practising
More SAA-C03 practice questions
- A content publishing system uses Lambda functions that call an unreliable third-party API. Failed events must be retaine…
- A startup runs two EC2-based workloads in the same AWS Region. Its customer-facing API is always on, and its nightly vid…
- A warehouse integration service must use shared file storage across Linux EC2 instances in multiple Availability Zones.…
- A team runs a stateless web app on Amazon EC2 behind an Application Load Balancer. During traffic spikes, new EC2 instan…
- A service in private subnets downloads product images from Amazon S3 and stores job state in DynamoDB. A NAT Gateway is…
- A static site is hosted in Amazon S3 and delivered by CloudFront. After a frontend release, the same JavaScript bundles…
Last reviewed: May 17, 2026
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.
Question Discussion
Share a tip, memory trick, or ask about the reasoning behind this question. Do not post real exam questions, leaked content, braindumps, or copyrighted exam material. Comments are moderated and may be removed without notice.
Sign in to join the discussion.