SOA-C03 practice question 3 of 10

A company requires the rotation of administrative credentials for production workloads on a regular basis. A CloudOps engineer must implement this…

Choose your answer, then check it against the explanation and the full breakdown below.

Domain Security and Compliance

A company requires the rotation of administrative credentials for production workloads on a regular basis. A CloudOps engineer must implement this policy for an Amazon RDS DB instance's master user password. Which solution will meet this requirement with the LEAST operational effort?

Answer options

Correct Answer:

Explanation

AWS Secrets Manager is the purpose-built service for managing the lifecycle of secrets, including credentials for services like Amazon RDS. It offers a fully managed, out-of-the-box solution for automatic password rotation. By creating a secret for the RDS database and enabling rotation, Secrets Manager automatically provisions and manages an AWS Lambda function to handle the entire rotation process. This approach requires only configuration and eliminates the need to write, test, or maintain custom code, thereby representing the least operational effort to meet the requirement.

Why Incorrect

A. This is a valid but high-effort solution. It requires the engineer to write, deploy, and maintain a custom Lambda function and its associated permissions, which is more operational overhead than the managed Secrets Manager solution.

B. AWS Systems Manager Parameter Store does not have a native, built-in capability to automatically rotate credentials for external services like Amazon RDS. A custom solution, such as a Lambda function, would still be required.

C. This option is incorrect for two reasons: it uses a plain String parameter, which is insecure for storing passwords, and Parameter Store does not natively support automatic rotation for RDS credentials.

---

References

1. AWS Secrets Manager User Guide

"Rotate secrets": "For secrets that store credentials for Amazon RDS... you can configure Secrets Manager to rotate the secret automatically. When you turn on automatic rotation

Secrets Manager uses a Lambda rotation function to rotate the secret." This document confirms that Secrets Manager provides a managed

automatic rotation feature specifically for RDS.

2. AWS Secrets Manager User Guide

"How rotation works": This section details the four-step process (createSecret

setSecret

testSecret

finishSecret) that the managed Lambda function performs

illustrating the complexity that is abstracted away from the user

thus minimizing operational effort.

3. AWS Systems Manager User Guide

"AWS Systems Manager Parameter Store": The documentation for Parameter Store describes its function for storing configuration data and secrets as parameters. It does not mention a native

managed feature for rotating credentials of other AWS services like RDS

which differentiates it from Secrets Manager.

4. AWS Security Blog

"AWS Secrets Manager vs. Systems Manager Parameter Store": "Secrets Manager offers secret rotation with built-in integration for Amazon RDS... If you need to rotate secrets

you should use Secrets Manager." This official blog post explicitly recommends Secrets Manager over Parameter Store for use cases involving credential rotation.

Question 3 of 10

Question breakdown

Tests: Automate credential rotation for Amazon RDS
Difficulty: Easy

Key idea: AWS Secrets Manager has native, managed rotation for RDS credentials, so no custom rotation code is needed.

How to reach the answer

The goal is rotating the RDS master password on a schedule.
The phrase LEAST operational effort rules out writing custom code.
Parameter Store has no built-in automatic rotation for RDS credentials.
Secrets Manager integrates with RDS and provides managed rotation on a schedule.
Secrets Manager is therefore the lowest-effort fit.

Each option

AIncorrect. It works, but a custom Lambda function plus an EventBridge schedule must be built and maintained, which is more effort.
BIncorrect. SecureString parameters are encrypted, but Parameter Store cannot automatically rotate RDS passwords.
CIncorrect. A plain String parameter stores the password unencrypted, and Parameter Store has no native rotation.
DCorrect. Secrets Manager stores the RDS secret and rotates it automatically through managed rotation, with minimal setup.

Common trap: Parameter Store SecureString seems like an equivalent, cheaper secret store, but it lacks managed rotation.

In practice: Many teams enable RDS managed master user passwords in Secrets Manager so the password is rotated automatically and applications retrieve it at runtime.

Remember: Choose Secrets Manager whenever credentials need automatic rotation; Parameter Store does not rotate them.

Official documentation: Rotate AWS Secrets Manager secrets · Password management with Amazon RDS and AWS Secrets Manager

Drafted with AI assistance and checked against the answer key.

Keep practicing

Take the free SOA-C03 practice test

Ten exam-style questions with answers and explanations, plus the exam facts and study guides.

Start the free practice test