A software company is conducting a security audit of its three-node Amazon Aurora MySQL DB cluster. Which finding is a security concern that needs to be addressed?

The AWS account root user should have minimum privileges and never be used for client applications; this is a best practice, not a security concern.

Aurora encrypts data at rest (including backups) when configured, and AWS securely handles internal data transfer for native backup processes, so this is not typically a user-configurable security finding.

Placing each Aurora DB cluster node in a separate VPC is an impractical and overly complex network architecture; Aurora nodes are typically placed in private subnets within the same VPC, secured by security groups.

Failing to regularly rotate IAM credentials used by an application is a critical security vulnerability, as it increases the risk of credential compromise and unauthorized access if those credentials are leaked or stolen.