Question 1mediummultiple choice
Full question →Question 230 of 1,000
mediummultiple choiceObjective-mapped
SAA-C03 Practice Question: AWS Secrets Manager provides native automatic…
This SAA-C03 practice question tests your understanding of aws secrets manager provides native automatic…. Match the stated requirement to the specific cloud service, access model, or configuration option — many options are valid in isolation but not for this scenario. A key principle to apply: aWS Secrets Manager provides native automatic rotation for RDS credentials. Once you have made your selection, read the full explanation to reinforce the concept and understand why each distractor is designed to mislead on exam day.
A company stores RDS database credentials in AWS Systems Manager Parameter Store as SecureString parameters. The security team requires that database passwords rotate automatically every 30 days. Which change should a solutions architect recommend?
Answer choices
Why each option matters
Good practice is not just finding the correct option. The wrong answers often show the exact trap the exam wants you to fall into.
A
Distractor review
Configure AWS Config to detect password age and trigger an SNS notification after 30 days
AWS Config detects compliance issues but cannot rotate credentials. SNS is a notification service — it cannot generate or update passwords.
B
Distractor review
Create a scheduled EventBridge rule to invoke a Lambda function that updates the Parameter Store SecureString value every 30 days
This works but requires custom development and lacks native rotation history. Secrets Manager provides this functionality without custom code.
C
Best answer
Migrate the credentials to AWS Secrets Manager and enable automatic rotation with a 30-day schedule
Secrets Manager provides native automatic rotation for RDS with a managed Lambda function. This meets the requirement with minimal operational overhead.
D
Distractor review
Enable Parameter Store SecureString automatic rotation in the AWS console
Automatic rotation is not a built-in feature of Parameter Store. This option does not exist. Rotation must be implemented with custom Lambda code.
Common exam trap
Common exam trap: answer the scenario, not the keyword
Both services encrypt values using KMS, which causes candidates to treat them as equivalent. Only Secrets Manager provides automatic rotation with managed Lambda integration and rotation history. Parameter Store is appropriate for configuration values and static secrets. Whenever automatic rotation is a security policy requirement, Secrets Manager is the answer.
Technical deep dive
How to think about this question
Secrets Manager vs Parameter Store comparison: - Automatic rotation: Secrets Manager YES (built-in for RDS, Redshift, DocumentDB) | Parameter Store NO (requires custom Lambda) - Rotation history: Secrets Manager YES | Parameter Store NO - Cost: Secrets Manager $0.40/secret/month + API calls | Parameter Store free tier (standard) - Cross-account resource policy: Secrets Manager YES | Parameter Store limited Rule: Use Secrets Manager when a secret must rotate or when audit history is required. Use Parameter Store for app configuration and non-rotating secrets.
KKey Concepts to Remember
- AWS Secrets Manager provides native automatic rotation for RDS credentials
- Parameter Store SecureString does not support automatic rotation without custom Lambda
- Secrets Manager deploys a managed Lambda that generates, updates DB password, and updates the secret atomically
- Both services use AWS KMS for encryption
- Secrets Manager costs $0.40/secret/month; Parameter Store has a free tier
TExam Day Tips
- Watch for words such as best, first, most likely and least administrative effort.
- Review why wrong options are wrong, not only why the correct option is correct.
Key takeaway
AWS Secrets Manager provides native automatic rotation for RDS credentials
Related practice questions
Related SAA-C03 practice-question pages
Use these pages to review the topic behind this question. This is how one missed question becomes focused revision.
SAA-C03 VPC practice questions
Practise SAA-C03 questions linked to SAA-C03 VPC.
SAA-C03 S3 lifecycle policy questions
Practise SAA-C03 questions linked to SAA-C03 S3 lifecycle policy questions.
SAA-C03 RDS Multi-AZ questions
Practise SAA-C03 questions linked to SAA-C03 RDS Multi-AZ questions.
SAA-C03 IAM policy practice questions
Practise SAA-C03 questions linked to SAA-C03 IAM policy.
SAA-C03 Route 53 failover questions
Practise SAA-C03 questions linked to SAA-C03 Route 53 failover questions.
SAA-C03 CloudFront practice questions
Practise SAA-C03 questions linked to SAA-C03 CloudFront.
SAA-C03 NAT gateway questions
Practise SAA-C03 questions linked to SAA-C03 NAT gateway questions.
SAA-C03 VPC endpoint questions
Practise SAA-C03 questions linked to SAA-C03 VPC endpoint questions.
SAA-C03 Auto Scaling practice questions
Practise SAA-C03 questions linked to SAA-C03 Auto Scaling.
SAA-C03 disaster recovery questions
Practise SAA-C03 questions linked to SAA-C03 disaster recovery questions.
SAA-C03 high availability questions
Practise SAA-C03 questions linked to SAA-C03 high availability questions.
SAA-C03 cost optimization questions
Practise SAA-C03 questions linked to SAA-C03 cost optimization questions.
More questions from this exam
Keep practising from the same exam bank, or move into a focused topic page if this question exposed a weak area.
Question 1
A team needs to distribute TCP traffic (not HTTP) across multiple services. The services must see the original client source IP for auditing. Which AWS load balancer is the best fit?
Question 2
A team wants to run containerized services with AWS-managed orchestration and autoscaling. They do NOT require Kubernetes compatibility. Which AWS service choice is most appropriate to meet these goals?
Question 3
A solutions architect is designing an S3 bucket for a IoT ingestion API. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure? The design must avoid adding custom operational scripts.
Question 4
A solutions architect is designing an S3 bucket for a claims portal. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?
Question 5
A team wants to delegate IAM management to developers, but must ensure developers can never grant themselves permissions beyond a specific limit. Which AWS mechanism best matches this requirement?
Question 6
A solutions architect is designing an S3 bucket for a healthcare document service. The objects must never be publicly accessible, even if a developer later adds an overly broad bucket policy. What should the architect configure?
Practice this exam
Start a free SAA-C03 practice session
Short sessions build daily habit. Longer sessions build exam-day stamina. Try a timed session to simulate real conditions.
FAQ
Questions learners often ask
What does this SAA-C03 question test?
AWS Secrets Manager provides native automatic rotation for RDS credentials
What is the correct answer to this question?
The correct answer is: Migrate the credentials to AWS Secrets Manager and enable automatic rotation with a 30-day schedule — AWS Secrets Manager provides native automatic rotation for RDS credentials using a managed Lambda function that rotates the secret on a defined schedule and updates the database password atomically. Parameter Store SecureString does not support built-in automatic rotation — rotation must be implemented manually with custom automation. Secrets Manager is specifically designed for secrets requiring lifecycle management including rotation, auditing, and fine-grained access control.
What should I do if I get this SAA-C03 question wrong?
Review aWS Secrets Manager provides native automatic rotation for RDS credentials, then practise related SAA-C03 questions on the same topic to reinforce the concept.
About these practice questions
Courseiva creates original exam-style practice questions with explanations and wrong-answer analysis. It does not publish real exam questions, exam dumps, or protected exam content. Learn why practice questions differ from exam dumps →
Discussion
Loading comments…
Sign in to join the discussion.
This SAA-C03 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAA-C03 exam.