SOA-C02 Security and Compliance Practice Question

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

• ✗

  AWS Identity and Access Management (IAM)

  Why it's wrong here

  AWS Identity and Access Management (IAM) governs identities, authentication, and authorization for AWS APIs, including users, groups, roles, and policies. It is not designed to store application secrets such as database passwords; IAM credentials are for accessing AWS APIs, not for use by an application to authenticate to an external database. While IAM can enable database authentication for some services (e.g., RDS IAM authentication) by eliminating passwords, it still does not store arbitrary secret values, and attempting to use IAM as a secrets manager would violate its security model and provide no mechanism for secret rotation or access auditing at the secret level.

• ✓

  AWS Secrets Manager

  Why this is correct

  AWS Secrets Manager is a purpose-built service for securely storing and managing database credentials, API keys, and other secrets throughout their lifecycle. It natively supports automatic rotation, either through built-in integration with AWS services like RDS, Redshift, and DocumentDB, or via custom AWS Lambda rotations. Unlike generic parameter storage, Secrets Manager enforces fine-grained IAM access policies and provides audit trails via AWS CloudTrail, making it the recommended choice for production secrets that require rotation and regulated access.

• ✗

  AWS Key Management Service (KMS)

  Why it's wrong here

  AWS Key Management Service (KMS) is a key management system that creates and controls customer master keys for cryptographic operations, not a secret storage service. KMS can encrypt data, including secrets, but the resulting ciphertext must be stored somewhere else (e.g., a file or Parameter Store). It does not provide a native interface to store and retrieve plaintext secrets on demand, nor does it support secret versioning or rotation of secret values; its role is to protect encryption keys and perform cryptographic operations, not act as a secrets repository.

• ✗

  AWS Systems Manager Parameter Store

  Why it's wrong here

  AWS Systems Manager Parameter Store can store secrets as 'SecureString' parameters encrypted with AWS KMS, making it a low-cost alternative for simple secret storage. However, Parameter Store lacks native automatic rotation—rotating a secret requires building a custom AWS Lambda function and scheduling it to update the parameter value. It also does not have built-in integrations with database services for automated credential rotation, and its versioning and access audit capabilities are more limited than those offered by Secrets Manager, making it a poor fit for environments requiring regular, automated rotation.

Go deeper

Related to this question