SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Identity and Access Management (IAM)

  Why it's wrong here

  AWS Identity and Access Management (IAM) is a web service for managing identities and permissions, not for storing secrets. It uses users, groups, roles, and policies to control access to AWS resources, but it has no native facility to persist database credentials or manage their lifecycle. While IAM database authentication exists for Amazon RDS, it requires the database engine to support it and is a separate feature, not a secret store. Therefore, IAM cannot meet the requirements of securely storing and automatically rotating database credentials.

• ✗

  AWS Key Management Service (KMS)

  Why it's wrong here

  AWS Key Management Service (KMS) is a managed service for creating and controlling customer master keys (CMKs) that encrypt data at rest and in transit. KMS itself does not store arbitrary secrets like database credentials; it only manages the cryptographic keys used to encrypt them. While KMS can be used to encrypt a secret value, you must build custom logic to store, retrieve, and rotate that secret, and KMS does not provide rotation of secret values—it can only rotate the underlying CMKs. Even though AWS Secrets Manager uses KMS to encrypt its secret payloads, KMS alone lacks the secret storage and rotation capabilities required by this scenario.

• ✓

  AWS Secrets Manager

  Why this is correct

  AWS Secrets Manager is a purpose-built service for storing and managing secrets, including database credentials, with native support for automatic rotation. It uses AWS Lambda functions to rotate credentials for supported services such as Amazon RDS, Redshift, and DocumentDB, without requiring custom code. Secrets Manager also integrates with IAM for fine-grained access control and with KMS for encryption of the secret payload at rest. This makes it the correct choice because it directly satisfies both requirements: secure storage and automated rotation.

• ✗

  AWS Systems Manager Parameter Store

  Why it's wrong here

  Parameter Store lacks native automated secret rotation; it requires custom logic via AWS Lambda or EventBridge to rotate credentials, whereas AWS Secrets Manager provides built-in rotation with integrated Lambda templates. It is tempting because Parameter Store securely stores configuration data and secrets, and would be correct for non-rotating secrets or configuration parameters where manual updates are acceptable.

Go deeper

Related to this question