SAP-C02 Design for New Solutions Practice Question
A company is designing a new two-tier web application on AWS. The web tier runs on Amazon EC2 instances behind an Application Load Balancer (ALB), and the database tier uses Amazon RDS for MySQL. The company requires that the database credentials be automatically rotated every 30 days without application downtime. The application retrieves credentials from a centralized store at runtime. Which solution meets these requirements?
⚠ Common exam trap
Many candidates confuse IAM database authentication with password-based authentication, or assuming Parameter Store provides automatic rotation when it does not.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the database credentials in AWS Secrets Manager and enable automatic rotation with a Lambda rotation function.
The requirement is for automatic rotation of database credentials every 30 days with no application downtime and a centralized store. AWS Secrets Manager provides native support for rotating RDS MySQL credentials using a Lambda rotation function, and applications can retrieve the latest credentials at runtime. This meets all the requirements without custom development. The other options either lack native rotation, are insecure, or use a different authentication mechanism that does not involve rotating credentials.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use IAM database authentication for RDS and store the IAM role credentials in AWS Secrets Manager with automatic rotation.
Why it's wrong here
IAM database authentication uses short-lived authentication tokens generated from IAM credentials, eliminating the need for password rotation. However, the question specifies storing database credentials and rotating them every 30 days. IAM database authentication does not use traditional credentials and does not require rotation, so it does not align with the stated requirement for credential rotation every 30 days.
- ✗
Store the database credentials in an encrypted Amazon S3 object and use an AWS Lambda function to rotate the credentials in RDS and update the S3 object.
Why it's wrong here
Storing credentials in S3 is not a secure or recommended practice for secrets management. While you can build a custom rotation mechanism, it lacks the native integration, auditing, and fine-grained access control of Secrets Manager. This approach increases risk and operational complexity, and does not provide automatic rotation as a managed feature.
- ✓
Store the database credentials in AWS Secrets Manager and enable automatic rotation with a Lambda rotation function.
Why this is correct
AWS Secrets Manager supports automatic rotation of database credentials using a Lambda rotation function. It can rotate RDS MySQL credentials every 30 days, and the application can retrieve the current credentials from Secrets Manager at runtime, ensuring no downtime. Secrets Manager integrates natively with RDS and provides a secure, centralized store.
- ✗
Store the database credentials in AWS Systems Manager Parameter Store as a SecureString parameter and configure automatic rotation using a Lambda function.
Why it's wrong here
Parameter Store SecureString parameters are encrypted with KMS, but Parameter Store does not provide built-in automatic rotation for RDS credentials. You would need to build and schedule a custom Lambda function to rotate credentials, which adds operational overhead and is not a native feature. This solution does not meet the requirement for automatic rotation out of the box.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
One of 984 original SAP-C02 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SAP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SAP-C02 exam.