SCS-C02 Data Protection Practice Question
A company uses AWS Secrets Manager to store database credentials. They need to rotate the secrets automatically every 30 days. Which rotation strategy should they use?
⚠ Common exam trap
Many exam-takers confuse AWS Systems Manager Parameter Store with Secrets Manager, thinking Parameter Store can also rotate secrets automatically, or they may incorrectly assume AWS Config rules can schedule rotations, when in fact only Secrets Manager with a Lambda function provides native automatic rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable automatic rotation in Secrets Manager and specify a Lambda rotation function.
AWS Secrets Manager natively supports automatic rotation of secrets, and you must specify an AWS Lambda function to perform the rotation logic (e.g., updating the database password and storing the new secret). This ensures the secret is rotated on a schedule (every 30 days) without manual intervention, meeting the requirement for automated rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use AWS Systems Manager Parameter Store to rotate the secret.
Why it's wrong here
AWS Systems Manager Parameter Store can store secrets as SecureString parameters, but it has no native rotation capability. Unlike AWS Secrets Manager, Parameter Store does not provide built-in scheduling or logic to update the secret value and the underlying database credential in tandem. You would have to build a custom rotation pipeline (e.g., with Lambda and EventBridge) from scratch, which lacks the integration, lifecycle tracking, and permissions management that Secrets Manager offers for automatic rotation.
- ✗
Manually update the secret every 30 days.
Why it's wrong here
Manually updating the secret every 30 days is not automatic and defeats the primary purpose of using a managed secrets service. This approach is prone to human error, leaves old credentials potentially active if not carefully decommissioned, and does not guarantee that all applications reading the secret receive the updated value in a coordinated way. It also fails to align with AWS's recommended pattern of scheduling rotation via Secrets Manager, which handles the rotation workflow without manual intervention.
- ✓
Enable automatic rotation in Secrets Manager and specify a Lambda rotation function.
Why this is correct
Enabling automatic rotation in AWS Secrets Manager and specifying a Lambda rotation function is the correct approach. Secrets Manager invokes the Lambda function on a configurable schedule (e.g., every 30 days), and the function follows the rotation protocol—creating a new credential, updating the database user/password, and storing the new value as a version of the secret. This allows applications to automatically retrieve the new credential via the secret ARN while keeping the database credential synchronized, and it supports multi-user or single-user rotation strategies.
- ✗
Use an AWS Config rule to trigger rotation.
Why it's wrong here
An AWS Config rule is designed to evaluate resource configurations for compliance, not to take actions that modify resources. While you could use a Config rule to check whether rotation is enabled on a secret, Config cannot directly perform secret rotation or update database credentials. Config remediation can trigger other services (like Systems Manager Automation) in some scenarios, but that is a separate action and Config itself has no native rotation function, so it is incorrect to say it triggers rotation of the secret.
Quick reference
Cloud Service Model Comparison
| Model | You Manage | Provider Manages | Examples |
|---|---|---|---|
| IaaS | OS, runtime, apps, data | Hardware, hypervisor, networking | EC2, Azure VMs, GCP Compute Engine |
| PaaS | Apps and data | OS, runtime, middleware, hardware | Elastic Beanstalk, Azure App Service |
| SaaS | Data and settings only | Everything else | Microsoft 365, Salesforce, Workday |
| FaaS / Serverless | Function code only | Infra, scaling, runtime | Lambda, Azure Functions, Cloud Run |
| CaaS | Containers and apps | Kubernetes, OS, hardware | EKS, AKS, GKE |
Go deeper
Related to this question
About these practice questions
Courseiva writes every SCS-C02 question from scratch — 1,205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SCS-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SCS-C02 exam.