Q55 — AWS SAA-C03 Ch.17

Question 55 of 89 | ← Chapter 17

Q1355. A company needs to migrate its customer transactions database from on premises to AWS. The database resides on an Oracle DB instance that runs on a Linux server.According to a new security requirement,the company must rotate the database password each year.Which solution will meet these requirements with the LEAST operational overhead?

Correct Answer: B. Migrate the database to Amazon RDS for Oracle. Store the password in AWS Secrets Manager. Turn on automatic rotation.Configure a yearly rotation schedule.

Explanation

The correct answer is B. Migrate the database to Amazon RDS for Oracle. Store the password in AWS Secrets Manager. Turn on automatic rotation. Configure a yearly rotation schedule.Explanation:The requirements are:Migrate an Oracle database from on-premises to AWS.Rotate the database password yearly with minimal operational overhead.Why Option B is correct:Amazon RDS for Oracle:A fully managed Oracle database service that reduces operational overhead (no need to manage OS, patches, or backups).Supports native Oracle features while offloading administrative tasks to AWS.AWS Secrets Manager:Securely stores and manages secrets (e.g., database passwords, API keys). Built-in automatic rotation for RDS databases (including Oracle). Supports custom rotation schedules (e.g., yearly rotation). Integrates with RDS to automatically update credentials after rotation.Least Operational Overhead:RDS handles backups, scaling, and patching.Secrets Manager automates password rotation without manual intervention.Why the other options are incorrect:A. Convert to Amazon DynamoDB + AWS SCT + CloudWatch + Lambda Incorrect:DynamoDB is a NoSQL database, not compatible with Oracle (relational) workloads. AWS SCT (Schema Conversion Tool) is for migrating schemas between different database engines (e.g., Oracle Aurora PostgreSQL), not to DynamoDB.CloudWatch + Lambda for yearly rotation adds unnecessary complexity when Secrets Manager already supports this.C. Migrate to Amazon EC2 + Parameter Store + Lambda for rotation Incorrect:EC2 requires manual management (OS updates, backups, scaling), increasing operational overhead. Parameter Store does not support automatic rotation--Lambda must be manually configured for yearly rotation, which is less efficient than Secrets Manager.D. Migrate to Amazon Neptune + AWS SCT + CloudWatch + Lambda Incorrect:Neptune is a graph database, incompatible with Oracle (relational) workloads. AWS SCT cannot convert Oracle to Neptune (different database paradigms). CloudWatch + Lambda for rotation is unnecessary when Secrets Manager provides a native solution.Key Considerations:Database Engine Compatibility:Oracle Amazon RDS for Oracle is the only option that maintains the same relational database engine. DynamoDB and Neptune are for specialized workloads (NoSQL, graph) and are not drop-in replacements for Oracle.Password Rotation Automation:AWS Secrets Manager is the best choice for automatic, secure credential rotation with minimal effort. Parameter Store requires manual rotation logic (Lambda), increasing overhead.Operational Overhead:RDS is fully managed, while EC2 requires manual maintenance. Avoid re-architecting the database (e.g., moving to DynamoDB/Neptune) unless the workload truly fits those models.Correct Architecture (Option B):Migrate Oracle database Amazon RDS for Oracle (using AWS DMS or native tools). Store password AWS Secrets Manager (with encryption at rest). Enable automatic rotation Configure Secrets Manager to rotate the password yearly. RDS automatically updates credentials after rotation (no application changes needed if using RDS proxy or IAM authentication).Conclusion:Option B is the only solution that meets all requirements:Maintains Oracle compatibility (RDS for Oracle).Automates yearly password rotation (Secrets Manager).Minimizes operational overhead (fully managed RDS + native rotation).The other options either use incompatible databases (DynamoDB, Neptune) or require manual rotation setup (EC2 + Parameter Store).