SCS-C02 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS KMS

  Why it's wrong here

  AWS KMS is a managed service that creates and controls customer master keys (CMKs) used for encrypting and decrypting data, not for storing secrets like database passwords. While KMS can encrypt a secret that lives elsewhere, it provides no native mechanism to store the credential itself, manage versions, or automatically rotate database passwords. Therefore, KMS alone cannot satisfy the requirement of securely storing and rotating database credentials.

• ✓

  AWS Secrets Manager

  Why this is correct

  AWS Secrets Manager is a purpose-built service for storing and managing database credentials, API keys, and other sensitive values. It natively supports automatic rotation of secrets using a customizable AWS Lambda function, with one-click integration for Amazon RDS, Redshift, and DocumentDB to rotate the password on the datastore as well. Because it combines secure storage, fine-grained IAM access control, secret versioning, and scheduled rotation, it directly meets the stated requirement for securely storing database credentials with automatic rotation.

• ✗

  AWS IAM roles for EC2

  Why it's wrong here

  IAM roles for EC2 provide temporary AWS credentials to instances through an instance profile, enabling the instance to call AWS APIs without embedding long-lived keys. They do not store or manage database passwords; database authentication username/password pairs are application-level secrets that must be delivered separately from the instance's AWS API credentials. Although Amazon RDS can use IAM database authentication instead of a password, that mechanism still doesn't involve storing the database password in a managed secret store, so IAM roles are the wrong service for this requirement.

• ✗

  AWS Systems Manager Parameter Store

  Why it's wrong here

  AWS Systems Manager Parameter Store can hold secrets as SecureString parameters, but it does not provide native automatic rotation of those secrets. To rotate a database password stored in Parameter Store, you must build and schedule custom automation (for example, Lambda plus EventBridge) to update both the parameter and the database, whereas Secrets Manager performs this rotation out of the box. Since the company's primary need is a securely stored database credential that rotates automatically, Parameter Store is not the best fit despite its lower cost.

Go deeper

Related to this question