A SysOps administrator needs to configure automatic rotation for Amazon RDS database credentials. The credentials must rotate every 30 days. The solution must integrate with Amazon RDS. Which…

Question

Options

• AStore the credentials in AWS Systems Manager Parameter Store as a secure string. Configure
• BStore the credentials in AWS Secrets Manager. Configure automatic rotation with a rotation
• CStore the credentials in a file in an Amazon S3 bucket. Deploy an AWS Lambda function to
• DStore the credentials in AWS Secrets Manager. Deploy an AWS Lambda function to automatically

• A
  10% (3)
• B
  80% (24)
• C
  3% (1)
• D
  7% (2)

Explanation

Option B is correct because AWS Secrets Manager has native, built-in integration with Amazon RDS - it can automatically rotate database credentials on a schedule (like every 30 days) without any custom code or additional infrastructure. You simply enable rotation and select the rotation interval; AWS handles everything else.

Why the others fall short:

• Option A (Parameter Store): Parameter Store does not have built-in automatic rotation for RDS credentials. You'd need to build custom automation around it, adding operational overhead.
• Option C (S3 file + Lambda): Storing credentials in a plain S3 file is a security anti-pattern, and deploying a custom Lambda for rotation is unnecessary manual work when a managed solution exists.
• Option D (Secrets Manager + custom Lambda): Secrets Manager can use a Lambda function for rotation, but when native RDS integration is available, deploying your own Lambda is extra overhead you don't need - the managed rotation handles it natively.

Memory tip: Think of Secrets Manager as the "set it and forget it" vault - whenever an AWS exam question mentions automatic rotation + RDS + least overhead, Secrets Manager's built-in rotation is almost always the answer. If you see "Lambda + Secrets Manager," that's the manual path and loses on the "least overhead" requirement.

No community discussion yet for this question.