DOP-C02 - Security and Compliance (17% of the exam) - Section 6.2

Automate secret and credential management using AWS Secrets Manager rotation, AWS Systems Manager Parameter Store and short-lived role credentials.

Store database credentials and API keys in AWS Secrets Manager and enable automatic rotation so applications always retrieve a fresh secret without code changes. Distinguish when to use Secrets Manager versus Parameter Store SecureString, and prefer short-lived temporary credentials from IAM roles over long-lived static keys.

AWS Secrets ManagerSecret rotationParameter StoreTemporary credentials

Practice question for this objective

Free sampleSecurity and Compliancemedium

A company stores the master password for an "Amazon RDS for PostgreSQL" database in "AWS Secrets Manager". Compliance requires the password to change automatically every 30 days, the database must keep working through each change, and the team wants the least custom code to build and maintain. Which approach BEST meets these requirements?

ASchedule an "Amazon EventBridge" rule every 30 days to invoke an "AWS Lambda" function the team writes that resets the database password and overwrites the stored secret value in place.
BStore the password in a "Parameter Store" "SecureString" parameter and rely on creating a new parameter version every 30 days to roll the credential forward for the database.
CEnable "Secrets Manager" managed rotation on the secret using the provided "Amazon RDS" rotation function and set the rotation schedule to every 30 days. Correct
DTurn on "Secrets Manager" rotation but point it at a fully custom Lambda function the team authors to call the database and update the secret every 30 days.

Use Secrets Manager managed rotation with the provided RDS rotation function to rotate a database password on a schedule without custom code or downtime. Secrets Manager managed rotation invokes the AWS-supplied RDS rotation function, which creates a new password, sets it on the database, tests it, and promotes the new secret version using staged labels so existing connections continue working; selecting a 30-day schedule satisfies the compliance interval with no rotation code for the team to own.

Why A is wrong: A hand-written Lambda triggered by EventBridge can change the password on a schedule, but it makes the team build and maintain the rotation logic and risks downtime during the swap, which is more overhead than the managed rotation the requirement wants.

Why B is wrong: Parameter Store keeps version history and encrypts the value, but it has no built-in rotation, so a new version does not change the password on the database, leaving the 30-day automatic-rotation requirement unmet.

Why C is correct: Managed rotation uses the AWS-provided RDS rotation function to update the password on the database and in the secret together on the chosen schedule, using a staged approach that keeps connections working, with no custom rotation code to maintain.

Why D is wrong: A custom rotation Lambda is appropriate when no managed function fits, but for a standard RDS database it duplicates logic AWS already provides, so it adds build and maintenance effort that the managed RDS rotation function removes.

See more DOP-C02 practice questions, answers explained.

Exam traps in Security and Compliance

Answers that look right on this material and are not. Each one is a distractor from a different question in the DOP-C02 bank for this domain.

Disable automatic rotation and instead change the password manually during a maintenance window so the application never sees two versions at once.
Why it is wrong: Manual changes in a window avoid version overlap but abandon automatic rotation, which the team wants to keep, so this trades the goal away rather than fixing the caching behaviour.
Put every setting and the API key into "Parameter Store" advanced parameters and build a scheduled "AWS Lambda" function that rotates the API key with the provider every 14 days.
Why it is wrong: Advanced parameters cost more than standard ones for rarely changing settings, and Parameter Store has no native rotation, so the team would maintain a custom rotator, adding both cost and overhead the requirement is trying to avoid.
Create an "AWS IAM" user in account B with a bucket-read policy, generate an access key pair, and store the keys in "Secrets Manager" in account A with rotation enabled.
Why it is wrong: Rotating keys in Secrets Manager limits their lifetime, but it still creates long-lived IAM user keys that the policy forbids, so this fails the no-long-lived-keys rule even though rotation reduces exposure.

Examworthy is not affiliated with or endorsed by Amazon Web Services. Original, blueprint-aligned practice material only.