An app needs to store a database password that must ROTATE automatically every 30 days with zero code changes. Which service provides built-in rotation?
A.Systems Manager Parameter Store SecureString
Encrypts but no native rotation — manual process required.
B.AWS Secrets Manager with automatic rotation via Lambda
Correct. Managed rotation is the headline feature.
C.Encrypted environment variables
Static — rotation means redeploying.
D.KMS-encrypted S3 objects
DIY storage, no rotation machinery.
Why this answer
Secrets Manager's built-in rotation (managed Lambda rotation for RDS/Redshift/documentDB, custom for others) is the differentiator. SecureString encrypts values but doesn't rotate — a commonly tested distinction.
Correct answer: B · Last reviewed 2026-11-03
Official AWS references
Practice this interactively
Answer without seeing the solution first in the Application Security practice session.
Practice Application Security