DBS-C01 · Question #23
A company wants to automate the creation of secure test databases with random credentials to be stored safely for later use. The credentials should have sufficient information about each test…
The correct answer is C. Add a resource of type AWS::SecretsManager::Secret and specify the GenerateSecretString. Explanation Option C is correct because AWS::SecretsManager::Secret with GenerateSecretString is specifically designed to automatically generate random credentials, store them securely in AWS Secrets Manager (encrypted at rest using KMS), and include structured metadata (like…
Question
A company wants to automate the creation of secure test databases with random credentials to be stored safely for later use. The credentials should have sufficient information about each test database to initiate a connection and perform automated credential rotations. The credentials should not be logged or stored anywhere in an unencrypted form. Which steps should a Database Specialist take to meet these requirements using an AWS CloudFormation template?
Options
- ACreate the database with the MasterUserName and MasterUserPassword properties set to the
- BAdd a Mapping property from the database Amazon Resource Name (ARN) to the secret ARN.
- CAdd a resource of type AWS::SecretsManager::Secret and specify the GenerateSecretString
- DCreate the secret with a chosen user name and a randomly generated password set by the
How the community answered
(22 responses)- A5% (1)
- B9% (2)
- C82% (18)
- D5% (1)
Explanation
Explanation
Option C is correct because AWS::SecretsManager::Secret with GenerateSecretString is specifically designed to automatically generate random credentials, store them securely in AWS Secrets Manager (encrypted at rest using KMS), and include structured metadata (like database connection details) needed for both initiating connections and performing automated credential rotations - all without ever exposing the credentials in plaintext logs or CloudFormation state.
Why the distractors are wrong:
- Option A is incomplete/incorrect because hardcoding or referencing credentials directly in
MasterUserNameandMasterUserPasswordproperties risks exposing them in CloudFormation templates, logs, or the AWS console in an unencrypted form. - Option B is insufficient alone because simply adding a mapping between a database ARN and a secret ARN doesn't create secure credentials or store them safely - it's just a reference structure.
- Option D is problematic because manually choosing a username and generating a password outside of Secrets Manager's built-in mechanism reintroduces the risk of credentials appearing in logs or templates unencrypted.
Memory Tip: Think "Generate → Secret → Rotate" - whenever you see requirements for random credentials, secure storage, and automated rotation, your immediate association should be AWS::SecretsManager::Secret with GenerateSecretString. Secrets Manager was purpose-built for exactly this use case.
Topics
Community Discussion
No community discussion yet for this question.