Exams / SOA-C03 / Secrets and parameters / Question 1
SOA-C03 practice question: Secrets and parameters
Security and Compliance A free question from our original SOA-C03 practice exam. Try it, then open the answer to see why each option is right or wrong.
A regional bank's loan application connects to an Amazon RDS for MySQL database with a username and password, and the application cannot be changed to another authentication method. Auditors now require the database password to change automatically every 30 days, and the application must always fetch the current password at runtime instead of storing it in configuration files. Which solution should a CloudOps engineer implement?
Choose one answer.
- AA. Store the password as a Parameter Store SecureString with an Expiration parameter policy set to 30 days.
- BB. Store the password in Secrets Manager and turn on managed rotation every 30 days.
- CC. Encrypt the password with a customer managed KMS key and turn on automatic key rotation for the key.
- DD. Turn on IAM database authentication for the DB instance so that the application receives a new token every 15 minutes.
Show the answer and explanation
Answer: B
Explanation
Secrets Manager is built for credentials that must rotate. Its rotation updates the password in the database and in the secret together, on a schedule, and applications fetch the current version when they need it. Parameter Store policies and KMS key rotation do not change the password itself.
Study
Keep practicing
Answer questions with a score at the end, or practice just this topic with the explanation after each one. No sign-up needed.