A security engineer is building a Java application that is running on Amazon EC2. The application communicates with an Amazon RDS instance and authenticates with a user name and password. Which…

Question

Options

• AHave a database administrator encrypt the credentials and store the ciphertext in Amazon S3.
• BConfigure a scheduled job that updates the credential in AWS Systems Manager Parameter Store
• CConfigure automatic rotation of credentials in AWS Secrets Manager.
• DStore the credential in an encrypted string parameter in AWS Systems Manager Parameter Store.
• EConfigure the Java application to catch a connection failure and make a call to AWS Secrets

• A
  4% (1)
• B
  4% (1)
• C
  76% (19)
• D
  16% (4)

Explanation

AWS Secrets Manager (C) natively supports automatic credential rotation for Amazon RDS - it rotates the password in both the secret store and the actual database without manual intervention. However, rotation creates a brief window where a running application may still hold the old (now-invalid) credentials, which is why option E is essential: the Java application should catch a connection failure and immediately call Secrets Manager to retrieve the fresh credentials, minimizing downtime to a single retry rather than a full outage.

Why the distractors are wrong:

• A: Manually encrypting ciphertext in S3 has no rotation mechanism and requires significant custom plumbing to retrieve and decrypt.
• B: A scheduled job updating Parameter Store is a manual, fragile process and Parameter Store lacks native RDS rotation integration.
• D: Parameter Store SecureString can store credentials securely, but it has no built-in automatic rotation for RDS like Secrets Manager does - so credentials still need to be rotated manually.

Memory tip: Think of it as a two-part contract - Secrets Manager rotates (C), and the app must retry on failure (E). If you only rotate without the retry logic, your app crashes; if you only retry without rotation, credentials never change. Both halves are required for a complete solution.

No community discussion yet for this question.