SAP-C02 Design for New Solutions Practice Question
A company is designing a new application that will be deployed on Amazon ECS with Fargate launch type. The application needs to store configuration data, including database connection strings, that must be encrypted at rest. The company wants to follow best practices for managing secrets. Which solution should the company use?
⚠ Common exam trap
Many candidates choose Systems Manager Parameter Store (Option C) because it is cheaper and also supports SecureString, but they overlook that AWS Secrets Manager is the specifically recommended service for secrets that require rotation and tighter integration with ECS, especially for database credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the secrets in AWS Secrets Manager and reference them in the ECS task definition.
AWS Secrets Manager is the recommended service for storing sensitive configuration data like database connection strings because it provides built-in encryption at rest using AWS KMS, automatic secret rotation, and fine-grained access control. ECS task definitions can reference Secrets Manager secrets directly using the 'secrets' parameter, which injects the secret value into the container at runtime without exposing it in plaintext. This approach follows AWS best practices for managing secrets by avoiding hard-coded values and leveraging a dedicated secrets management service.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the secrets in AWS Secrets Manager and reference them in the ECS task definition.
Why this is correct
Secrets Manager provides encryption, rotation, and ECS integration.
- ✗
Store the configuration data in an S3 bucket with server-side encryption (SSE-S3) and download it at container startup.
Why it's wrong here
This approach lacks automatic rotation and requires custom code to fetch secrets.
- ✗
Store the secrets in AWS Systems Manager Parameter Store (SecureString) and reference them in the ECS task definition.
Why it's wrong here
While Parameter Store is similar, Secrets Manager is the recommended service for secrets.
- ✗
Store the configuration data in environment variables in the ECS task definition.
Why it's wrong here
Environment variables are not encrypted at rest.
Go deeper
Related to this question
About these practice questions
Courseiva writes every SAP-C02 question from scratch — 1,660 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.