SCS-C02 Data Protection Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  Create an Amazon EventBridge rule that triggers a Lambda function to rotate the secret

  Why it's wrong here

  Creating an EventBridge rule to invoke a Lambda rotation function manually replicates Secrets Manager's built-in rotation scheduler. Secrets Manager already natively handles rotation timing, invokes the Lambda function with the appropriate secret ARN and token, and manages the secret's version staging labels. Adding EventBridge introduces an extra component that must be configured, monitored, and secured, increasing operational overhead without any functional benefit.

• ✗

  Use AWS CLI to schedule a cron job that runs every 30 days and rotates the secret

  Why it's wrong here

  Scheduling an AWS CLI command from a cron job requires an external compute environment, such as an EC2 instance, which must stay running and hold AWS CLI credentials. You would have to write custom logic to generate a new password, update the database, and then store the secret using the CLI, all while handling retries and failures manually. Unlike Secrets Manager's managed rotation, this approach lacks versioning, staging labels, and the built-in coordination with the database, making it fragile and high-overhead.

• ✗

  Use Amazon CloudWatch Events to invoke an AWS Lambda function that updates the secret

  Why it's wrong here

  Using CloudWatch Events to trigger a Lambda that simply updates the secret value bypasses the core of rotation: creating a new secret version and only marking it AWSCURRENT after the database has accepted the new credentials. A direct update overwrites the secret and can cause downtime if the database is not updated first, and you lose the AWSPREVIOUS version needed for rollback. Secrets Manager's rotation function template handles this safely via staging labels and secure invocation, whereas a custom EventBridge-triggered update does not.

• ✓

  Enable automatic rotation in Secrets Manager and configure the rotation interval to 30 days

  Why this is correct

  Enabling automatic rotation in Secrets Manager with a 30-day interval is the correct managed solution. Secrets Manager schedules the rotation, invokes the configured Lambda rotation function, and coordinates the change of the database password with the secret's version lifecycle using AWSCURRENT and AWSPREVIOUS staging labels. You simply choose the rotation interval, and the service handles all scheduling, retries, and permissions, providing the lowest operational overhead. This also works with common database services like RDS via the built-in rotation templates.

Go deeper

Related to this question