A company is developing a serverless application that requires storage of sensitive API keys as environment variables for various services. The application requires the automatic rotation of the…

Question

Options

• AEncrypt the environment variables by using AWS Secrets Manager. Set up automatic rotation in
• BEncrypt the environment variables by using AWS Key Management Service (AWS KMS)
• CEncrypt the environment variables by using AWS Key Management Service (AWS KMS) AWS
• DEncrypt the environment variables by using AWS Systems Manager Parameter Store. Set up

• A
  84% (16)
• B
  5% (1)
• D
  11% (2)

Explanation

AWS Secrets Manager (Option A) is purpose-built for storing application secrets like API keys and provides native, built-in automatic rotation - including annual schedules - requiring zero custom code or Lambda functions.

Why the distractors fail:

• B & C (AWS KMS): KMS manages encryption keys, not application-level secrets. It can encrypt data but has no mechanism to store or automatically rotate API keys without significant custom development.
• D (Systems Manager Parameter Store): Parameter Store can store secrets with KMS encryption, but automatic rotation of the stored values requires you to write and wire up a custom Lambda function - that's development effort, which violates the requirement.

The critical phrase in this question is "no development effort" - Secrets Manager is the only service with rotation built in out of the box, while Parameter Store rotation must be hand-coded.

Memory tip: Think "Secrets Manager = Secrets + Managed rotation." If the exam mentions secrets + automatic rotation + minimal effort, Secrets Manager wins. If it mentions secrets + cost sensitivity (Parameter Store is cheaper), but rotation isn't required, Parameter Store may be the answer instead.

No community discussion yet for this question.