nerdexam
Amazon

SAP-C02 · Question #326

A security engineer determined that an existing application retrieves credentials to an Amazon RDS for MySQL database from an encrypted file in Amazon S3. For the next version of the application…

The correct answer is A. Generate the database password as a secret resource using AWS Secrets Manager. https://aws.amazon.com/blogs/security/how-to-securely-provide-database-credentials-to-lambda- functions-by-using-aws-secrets-manager/ https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html…

Submitted by devops_kid· Mar 6, 2026Continuous Improvement for Existing Solutions

Question

A security engineer determined that an existing application retrieves credentials to an Amazon RDS for MySQL database from an encrypted file in Amazon S3. For the next version of the application, the security engineer wants to implement the following application design changes to improve security:

  • The database must use strong, randomly generated passwords stored in

a secure AWS managed service.

  • The application resources must be deployed through AWS

CloudFormation.

  • The application must rotate credentials for the database every 90

days. A solutions architect will generate a CloudFormation template to deploy the application. Which resources specified in the CloudFormation template will meet the security engineer's requirements with the LEAST amount of operational overhead?

Options

  • AGenerate the database password as a secret resource using AWS Secrets Manager.
  • BGenerate the database password as a SecureString parameter type using AWS Systems
  • CGenerate the database password as a secret resource using AWS Secrets Manager.
  • DGenerate the database password as a SecureString parameter type using AWS Systems

How the community answered

(42 responses)
  • A
    81% (34)
  • B
    10% (4)
  • C
    2% (1)
  • D
    7% (3)

Explanation

https://aws.amazon.com/blogs/security/how-to-securely-provide-database-credentials-to-lambda- functions-by-using-aws-secrets-manager/ https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html https://docs.aws.amazon.com/secretsmanager/latest/userguide/integrating_cloudformation.html

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full SAP-C02 Practice