A company is using AWS Secrets Manager to store secrets for its production Amazon RDS database. The Security Officer has asked that secrets be rotated every 3 months. Which solution would allow the…

Question

Options

• APlace the RDS instance in a public subnet and an AWS Lambda function outside the VPC.
• BPlace the RDS instance in a private subnet and an AWS Lambda function inside the VPC in the
• CPlace the RDS instance in a private subnet and an AWS Lambda function outside the VPC.
• DPlace the RDS instance in a private subnet and an AWS Lambda function inside the VPC in the
• EPlace the RDS instance in a private subnet and an AWS Lambda function inside the VPC in the

• A
  5% (2)
• B
  72% (31)
• C
  7% (3)
• D
  16% (7)

Explanation

Secrets Manager rotation works by triggering a Lambda function that connects to the database, generates a new credential, and updates the secret. For this to work securely, Lambda must be able to reach both the private RDS instance and the Secrets Manager API endpoint.

Why B and E are correct: RDS must stay in a private subnet (never exposed publicly), and the Lambda rotation function must be deployed inside the same VPC so it can reach the private RDS endpoint. Options B and E represent the two valid network paths for Lambda to call Secrets Manager from within the VPC: one using a NAT gateway for outbound internet access, and the other using a VPC endpoint (PrivateLink) for Secrets Manager - both are AWS-supported architectures for this rotation pattern.

Why the distractors are wrong:

• A puts RDS in a public subnet - a critical security violation that exposes the database directly to the internet.
• C places Lambda outside the VPC - it cannot reach the RDS instance in a private subnet without network connectivity.
• D is a variation that likely has an incomplete or incorrect network configuration (e.g., missing the endpoint or route needed to call Secrets Manager).

Memory tip: Think "Lambda must live where it works" - it needs to be inside the VPC to talk to private RDS, and it needs a path out (NAT gateway or VPC endpoint) to call the Secrets Manager API. Public RDS is always wrong in security questions.

No community discussion yet for this question.