A company has an application that uses different APIs to generate embeddings for input text. The company needs to implement a solution to automatically rotate the API tokens every 3 months. Which…

Question

Options

• AStore the tokens in AWS Secrets Manager. Create an AWS Lambda function to perform the
• BStore the tokens in AWS Systems Manager Parameter Store. Create an AWS Lambda function to
• CStore the tokens in AWS Key Management Service (AWS KMS). Use an AWS managed key to
• DStore the tokens in AWS Key Management Service (AWS KMS). Use an AWS owned key to

• A
  70% (16)
• B
  9% (2)
• C
  4% (1)
• D
  17% (4)

Explanation

AWS Secrets Manager (Option A) is purpose-built for storing, managing, and automatically rotating secrets like API tokens - it has native rotation scheduling built in, allowing you to configure automatic rotation on a defined schedule (e.g., every 90 days) using a Lambda function that Secrets Manager invokes for you.

Option B is wrong because Systems Manager Parameter Store can store secrets, but it does not have native automatic rotation functionality - you'd have to build and schedule the entire rotation mechanism yourself, making it a far more manual solution.

Options C and D are wrong because AWS KMS is designed to manage encryption keys, not to store or rotate third-party API tokens. KMS managed keys and KMS owned keys are used to encrypt/decrypt data, not to hold external credentials like API tokens at all.

Memory tip: Think "Secrets Manager = secret rotation manager." The word rotation is the giveaway - whenever an exam question mentions automatic rotation of credentials/tokens/passwords, Secrets Manager is almost always the answer. Parameter Store is for configuration values and basic secrets without rotation needs.

No community discussion yet for this question.