DOP-C02 practice question: Credential rotation for machine identities
Security and Compliance A free question from our original DOP-C02 practice exam. Try it, then open the answer to see why each option is right or wrong.
A SaaS startup runs its API on Amazon ECS. The API connects to a PostgreSQL database that runs on a self-managed EC2 instance, not on Amazon RDS, and the database password is stored in AWS Secrets Manager.
The security policy requires the password to rotate every 30 days, and the API must keep serving requests during each rotation without a restart outage. Each task reads the secret when it starts and then keeps its connection pool open.
The team wants a rotation that it can test before turning it on for production.
Which approach meets these requirements?
Choose one answer.
AA. Use a rotation function that changes the single database user's password in place in one step, then updates the secret, so the rotation is as short as possible.
BB. Rotate the password by hand each month, and have an engineer update the secret and restart the ECS service during a quiet period.
CC. Turn on rotation with a Lambda function that uses the alternating-users strategy and a superuser secret, testing the new user before AWSCURRENT moves.
DD. Store the password in an SSM Parameter Store SecureString instead, and rely on the parameter's expiration policy to remind the team to change it every 30 days.
Show the answer and explanation
Answer: C
A. Wrong: Changing a single user's password in place breaks existing connections and any task that reads the old secret before the update finishes. The API would see failed connections during each rotation.
C. Right: Correct. With two users, the previous credentials stay valid while tasks still hold the old secret, and the rotation tests the new credentials before the AWSCURRENT label moves. A superuser secret lets the function create the cloned user. Learn more: Lambda function rotation strategies (opens in a new tab)
A rotation with two database users, using the Secrets Manager staging labels, lets the new credential be created and tested while the old one still works. The switch happens by moving AWSCURRENT, and tasks that still hold the old secret keep working until they restart. Single-user in-place rotation, manual changes and parameter expiration each cause outages or leave the work to people.
Want more on Credential rotation for machine identities? The 5 full-length practice sets have 9 more Credential rotation for machine identities questions, 375 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →