nerdexam
Amazon

DVA-C02 · Question #246

A developer is creating an AWS Lambda function that will connect to an Amazon RDS for MySQL instance. The developer wants to store the database credentials. The database credentials need to be…

The correct answer is B. Store the database credentials in AWS Secrets Manager. Set up managed rotation on the. AWS Secrets Manager is the only AWS service that natively supports both encryption of credentials and automatic, managed rotation for RDS database passwords.

Submitted by suresh_in· Mar 5, 2026Security

Question

A developer is creating an AWS Lambda function that will connect to an Amazon RDS for MySQL instance. The developer wants to store the database credentials. The database credentials need to be encrypted and the database password needs to be automatically rotated. Which solution will meet these requirements?

Options

  • AStore the database credentials as environment variables for the Lambda function. Set the
  • BStore the database credentials in AWS Secrets Manager. Set up managed rotation on the
  • CStore the database credentials in AWS Systems Manager Parameter Store as secure string
  • DStore the database credentials in the X-Amz-Security-Token parameter. Set up managed rotation

How the community answered

(38 responses)
  • A
    3% (1)
  • B
    84% (32)
  • C
    8% (3)
  • D
    5% (2)

Why each option

AWS Secrets Manager is the only AWS service that natively supports both encryption of credentials and automatic, managed rotation for RDS database passwords.

AStore the database credentials as environment variables for the Lambda function. Set the

Lambda environment variables can be encrypted at rest with KMS but have no built-in automatic rotation capability for database passwords.

BStore the database credentials in AWS Secrets Manager. Set up managed rotation on theCorrect

AWS Secrets Manager encrypts secrets using AWS KMS and provides built-in managed rotation for Amazon RDS credentials. When rotation is configured, Secrets Manager automatically invokes a Lambda rotation function on a defined schedule, updating both the secret and the database password without manual intervention.

CStore the database credentials in AWS Systems Manager Parameter Store as secure string

SSM Parameter Store Secure Strings are encrypted with KMS but do not natively support automatic rotation of database credentials.

DStore the database credentials in the X-Amz-Security-Token parameter. Set up managed rotation

X-Amz-Security-Token is a temporary STS token field used in request signing, not a credential storage mechanism.

Concept tested: Secrets Manager automatic rotation for RDS credentials

Source: https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full DVA-C02 Practice