SAP-C02 Design for New Solutions Practice Question
A company is designing a new application that requires secure storage of secrets such as database passwords and API keys. The application runs on Amazon EC2 instances. The company wants to centralize secret management and automatically rotate secrets. Which AWS service should be used?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
AWS Secrets Manager
AWS Secrets Manager is designed for storing and rotating secrets centrally. Option A: AWS KMS is for encryption keys, not secret storage. Option B: AWS CloudHSM provides hardware security modules for key storage, not secret management with rotation. Option C: AWS Systems Manager Parameter Store can store secrets but does not natively rotate them; rotation requires custom solutions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
AWS Key Management Service (KMS)
Why it's wrong here
KMS manages encryption keys, not secrets.
- ✗
AWS CloudHSM
Why it's wrong here
CloudHSM provides hardware security modules, not secret storage.
- ✗
AWS Systems Manager Parameter Store
Why it's wrong here
AWS Systems Manager Parameter Store securely centralises the storage of configuration data and secrets, such as database passwords and API keys, aligning with the need for secure and centralised secret management. However, it does not offer native automatic secret rotation, a crucial requirement for this scenario. While Parameter Store is excellent for managing non-rotating parameters or secrets where rotation is handled by custom scripts, it fails to meet the explicit demand for *automatic* rotation.
- ✓
AWS Secrets Manager
Why this is correct
Secrets Manager provides secret storage with automatic rotation.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
About these practice questions
This SAP-C02 question is part of Courseiva's 1,660-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on SAP-C02
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A company needs to store configuration data for multiple applications in a centralized, secure, and versioned manner. The configuration must be encrypted at rest and automatically rotated. Which AWS service should they use?
easy- A.AWS CloudFormation
- B.AWS Secrets Manager
- ✓ C.AWS AppConfig
- D.AWS Systems Manager Parameter Store
Why C: AWS AppConfig supports versioned configuration, encryption at rest, and automatic rotation. Option A (AWS CloudFormation) is for infrastructure as code, not for storing application configuration. Option B (AWS Secrets Manager) is designed for managing secrets (e.g., passwords, API keys), not general configuration data. Option D (AWS Systems Manager Parameter Store) can store configuration but does not support automatic rotation of configuration values.
Variation 2. A company wants to store configuration data for multiple applications securely. Each application runs on Amazon EC2 instances in an Auto Scaling group. The configuration includes database credentials and API keys. Which TWO services should be used together to achieve this?
easy- A.AWS Secrets Manager.
- B.Amazon S3 with bucket policies.
- ✓ C.IAM roles for EC2 instances.
- D.EC2 user data scripts.
- ✓ E.AWS Systems Manager Parameter Store.
Why C: And E. IAM roles for EC2 instances (C) allow EC2 to securely access other AWS services without hardcoding credentials. AWS Systems Manager Parameter Store (E) provides secure, hierarchical storage for configuration data and secrets. Together, they enable EC2 to retrieve configuration data like database credentials and API keys at runtime without embedding secrets in code or user data. Option A (Secrets Manager) is also valid for secrets, but the question asks for two services, and the marked correct pair is C and E. Option B (S3 with bucket policies) is insecure for secrets, and option D (EC2 user data) is not secure for credentials.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.