A SysOps administrator needs to secure the credentials for an Amazon RDS database that is created by an AWS CloudFormation template. The solution must encrypt the credentials and must support…

The correct answer is C. Create an AWS::SSM::Parameter resource in the CloudFormation template. There appears to be an error in this question worth flagging before explaining it. The marked correct answer (C) is likely wrong. AWS SSM Parameter Store (AWS::SSM::Parameter) can encrypt values via SecureString, but it does not natively support automatic credential rotation…

Submitted by priya_blr· Mar 30, 2026Security and Compliance

Question

A SysOps administrator needs to secure the credentials for an Amazon RDS database that is created by an AWS CloudFormation template. The solution must encrypt the credentials and must support automatic rotation. Which solution will meet these requirements?

Options

ACreate an AWS::SecretsManager::Secret resource in the CloudFormation template.
BCreate an AWS::SecretsManager::Secret resource in the CloudFormation template.
CCreate an AWS::SSM::Parameter resource in the CloudFormation template.
DCreate parameters for the database credentials in the CloudFormation template.

How the community answered

(46 responses)

A
4% (2)
B
15% (7)
C
74% (34)
D
7% (3)

Explanation

There appears to be an error in this question worth flagging before explaining it.

The marked correct answer (C) is likely wrong. AWS SSM Parameter Store (AWS::SSM::Parameter) can encrypt values via SecureString, but it does not natively support automatic credential rotation - that requires custom Lambda logic.

The actual correct answer should be A or B (they are identical, which suggests a formatting error in the question source). AWS::SecretsManager::Secret satisfies both requirements:

Encryption: Secrets Manager encrypts credentials using AWS KMS by default.
Automatic rotation: It natively integrates with RDS to rotate credentials on a defined schedule via a managed Lambda function.

Why the distractors fail:

C (SSM Parameter Store): Supports encryption via SecureString, but has no built-in automatic rotation - fails the second requirement.
D (CloudFormation parameters): Credentials stored as plain CloudFormation parameters are not encrypted and have no rotation capability - fails both requirements.

Memory tip: When you see "encrypt + automatic rotation" together, think Secrets Manager - it's the only AWS-native service designed for the full credential lifecycle. SSM Parameter Store is for configuration; Secrets Manager is for secrets.

Recommend verifying this question against your source material, as the duplicate options and incorrect answer key suggest a transcription error.

Topics

#CloudFormation#Secrets Management#SSM Parameter Store#Encryption

Community Discussion

No community discussion yet for this question.

Full SOA-C02 Practice