nerdexam
Amazon

DBS-C01 · Question #272

A company is creating a serverless application that uses multiple AWS services and stores data on an Amazon RDS DB instance. The database credentials must be stored securely. An AWS Lambda function…

The correct answer is C. Store the database credentials by using AWS Secrets Manager. Enable automatic rotation of the. To securely store and automatically rotate database credentials for an AWS Lambda function accessing an Amazon RDS instance, AWS Secrets Manager is the most secure and automated solution.

Submitted by priya_blr· Mar 6, 2026Database Security

Question

A company is creating a serverless application that uses multiple AWS services and stores data on an Amazon RDS DB instance. The database credentials must be stored securely. An AWS Lambda function must be able to access the credentials. The company also must rotate the database password monthly by using an automated solution. What should a database specialist do to meet those requirements in the MOST secure manner?

Options

  • AStore the database credentials by using AWS Systems Manager Parameter Store. Enable
  • BEncrypt the database credentials by using AWS Key Management Service (AWS KMS). Store the
  • CStore the database credentials by using AWS Secrets Manager. Enable automatic rotation of the
  • DStore the database credentials in an Amazon DynamoDB table. Assign an IAM role to the

How the community answered

(27 responses)
  • A
    7% (2)
  • B
    4% (1)
  • C
    78% (21)
  • D
    11% (3)

Why each option

To securely store and automatically rotate database credentials for an AWS Lambda function accessing an Amazon RDS instance, AWS Secrets Manager is the most secure and automated solution.

AStore the database credentials by using AWS Systems Manager Parameter Store. Enable

AWS Systems Manager Parameter Store can securely store credentials (SecureString), but it does not offer built-in automated password rotation capabilities for RDS databases, requiring manual or custom automation.

BEncrypt the database credentials by using AWS Key Management Service (AWS KMS). Store the

AWS Key Management Service (KMS) is used for encryption, but it is not a secret storage or rotation service itself; it would only provide encryption for credentials stored elsewhere, without addressing automated rotation.

CStore the database credentials by using AWS Secrets Manager. Enable automatic rotation of theCorrect

AWS Secrets Manager is a dedicated service for securely storing and managing secrets, including database credentials, and integrates directly with Amazon RDS to provide automated, scheduled password rotation. AWS Lambda functions can then securely retrieve these credentials programmatically, ensuring all requirements are met in a highly secure and automated manner.

DStore the database credentials in an Amazon DynamoDB table. Assign an IAM role to the

Storing database credentials in an Amazon DynamoDB table is not a recommended security best practice for secret management and does not provide native features for automated password rotation or secure credential retrieval specifically designed for this purpose.

Concept tested: Secure secret management and rotation with AWS Secrets Manager

Source: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

Topics

#Secrets Manager#database credentials#automated rotation#Lambda

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DBS-C01 Practice