A company is building a new application using AWS CDK. The application requires a database password to connect to Amazon RDS. The security team mandates that the password must be automatically rotated every 30 days without any application downtime. Which solution meets these requirements?

Answer options:

Store the password in AWS Systems Manager Parameter Store as a SecureString. Use EventBridge to trigger a Lambda function for rotation.

Store the password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.

Store the password in AWS KMS and set the key rotation policy to 30 days.

Hardcode the password in the CDK code and use a CI/CD pipeline to redeploy every 30 days.

How to approach this question

Identify the service specifically designed for database credential rotation.

Full Answer

B.Store the password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.✓ Correct

Store the password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.

AWS Secrets Manager is specifically designed to manage, retrieve, and automatically rotate database credentials. It provides built-in integration with Amazon RDS and uses Lambda functions to safely rotate the password without causing application downtime.

Common mistakes

Confusing KMS key rotation with database password rotation.

Question 30 All questions Question 32

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 4

75 questions · hints · full answers · grading

More questions from this exam

Q01A global enterprise is redesigning its network architecture across 50 AWS accounts. They require ...Hard Q02A financial services company uses AWS Organizations to manage 100+ accounts. The security team ma...Medium Q03An e-commerce company requires a multi-region active-active architecture for its critical order p...Medium Q04A company is setting up a new AWS environment using AWS Control Tower. They need to ensure that a...Hard Q05An enterprise has 50 AWS accounts under AWS Organizations. They want to implement a chargeback mo...Medium

View all 75 questions →