SCS-C02 Infrastructure Security Practice Question
A company uses AWS Lambda functions that access an Amazon RDS for MySQL database. The Lambda functions are configured with environment variables containing the database credentials. A security audit reveals that the credentials are stored in plaintext in the Lambda configuration. The security team wants to remediate this by using AWS Secrets Manager to store and automatically rotate the credentials. The Lambda functions are invoked frequently, and the team wants to minimize the impact of rotation on running functions. Which solution meets these requirements with the LEAST operational overhead?
⚠ Common exam trap
The trap here is assuming that encrypting environment variables with KMS is sufficient, but it does not remove the plaintext credentials from the Lambda configuration nor does it rotate them.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the credentials in Secrets Manager with automatic rotation enabled. Modify the Lambda functions to retrieve the secret at runtime using the Secrets Manager API and cache the secret using the AWS SDK.
AWS Secrets Manager is designed to store and rotate database credentials automatically. By modifying the Lambda function to retrieve the secret at runtime and caching it, you reduce the number of API calls while ensuring that rotated credentials are eventually used. This approach provides security with minimal operational overhead because Secrets Manager handles rotation without custom code.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS KMS to encrypt the environment variables in the Lambda configuration. Enable automatic rotation of the KMS key.
Why it's wrong here
Encrypting environment variables with KMS protects data at rest, but the credentials are still stored in the Lambda configuration and are visible in plaintext to anyone with access to the function's configuration. KMS key rotation does not rotate the database credentials themselves. This does not meet the requirement to use Secrets Manager with automatic rotation.
- ✓
Store the credentials in Secrets Manager with automatic rotation enabled. Modify the Lambda functions to retrieve the secret at runtime using the Secrets Manager API and cache the secret using the AWS SDK.
Why this is correct
This approach centralizes secret storage, enables automatic rotation, and uses caching to reduce API calls and latency. The Lambda function retrieves the secret at runtime; caching ensures that frequent invocations do not overwhelm Secrets Manager and that rotated credentials are picked up after cache expiry. This minimizes operational overhead and improves security.
- ✗
Store the credentials in Secrets Manager and pass the secret ARN as an environment variable. Configure the Lambda function to retrieve the secret on each invocation without caching.
Why it's wrong here
Retrieving the secret on every invocation without caching increases latency and API calls to Secrets Manager, potentially causing throttling and higher costs. It also adds unnecessary overhead. While secure, this approach is not optimal for frequently invoked functions; caching is recommended to reduce load and improve performance.
- ✗
Store the credentials in AWS Systems Manager Parameter Store as a SecureString parameter with automatic rotation. Modify the Lambda function to read the parameter at runtime.
Why it's wrong here
Parameter Store SecureString can store secrets, but it lacks native automatic rotation for RDS credentials. You would need to implement custom rotation using Lambda, which adds operational overhead. Secrets Manager provides built-in rotation for RDS, making it a better fit for this scenario where least operational overhead is desired.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
This SCS-C02 question is part of Courseiva's 1,205-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.