SAA-C03 Q474 · Security

Question

A company has a web application that uses several web servers that run on Amazon EC2 instances. The instances use a shared Amazon RDS for MySQL database. The company requires a secure method to store database credentials. The credentials must be automatically rotated every 30 days without affecting application availability. Which solution will meet these requirements?

Accepted Answer

**Answer A is correct because AWS Secrets Manager is purpose-built for this exact use case.** Here's how it satisfies every requirement:

1. **Secure storage**: Secrets Manager encrypts credentials at rest using AWS KMS. Credentials are never stored in plaintext.

2. **Automatic rotation every 30 days**: Secrets Manager has **native, built-in rotation support** for Amazon RDS databases (MySQL, PostgreSQL, Oracle, SQL Server, MariaDB). You configure a rotation schedule (e.g., every 30 days), and Secrets Manager handles it automatically using a Lambda function it provisions for you.

3. **No impact on application availability**: Secrets Manager supports **multi-user rotation strategies** (alternating users strategy) that ensure the old credentials remain valid while new ones are being set. T

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips