SCS-C03 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✓

  Enable rotation in Secrets Manager and use a provided Lambda template to update the RDS credentials.

  Why this is correct

  Using the built-in Secrets Manager rotation feature with a Lambda function is the AWS-recommended approach. The Lambda function handles the multi-step rotation process, which includes creating a new secret version, updating the database password, and testing the new credentials before finalizing the rotation to prevent application downtime.

• ✗

  Use an Amazon EventBridge rule to trigger a manual password reset on the RDS instance every 30 days.

  Why it's wrong here

  While EventBridge can schedule tasks, manually resetting the RDS password does not update the secret stored in Secrets Manager. This would cause applications to fail because they would still be attempting to use the old, invalidated credentials. A coordinated update between the database and the secret store is required.

• ✗

  Store the credentials in an S3 bucket with versioning and use a Lifecycle policy to rotate the files.

  Why it's wrong here

  S3 Lifecycle policies are designed for transitioning or deleting objects based on age, not for rotating credentials. This approach lacks the necessary logic to communicate with the database and update its internal user records. Secrets Manager is specifically designed for this purpose and provides much stronger security controls.

• ✗

  Configure the RDS instance to automatically pull new credentials from Secrets Manager using IAM roles.

  Why it's wrong here

  RDS instances do not have a native feature to 'pull' credentials from Secrets Manager to update their own master passwords. Rotation is a push-based operation where an external entity, like a Lambda function, updates both the database and the secret store to ensure they remain synchronized at all times.