Least Overhead Credential Storage and Retrieval

SAA-C03 By islever Editorial Last updated

Determine appropriate data security controls.

Short answer

D Store credentials in AWS Secrets Manager and use CloudFormation with the BatchGetSecretValue API for retrieval.

Question

A company is designing a new internal web application in the AWS Cloud. The new application must securely retrieve and store multiple employee usernames and passwords from an AWS managed service. Which solution will meet these requirements with the LEAST operational overhead?
  1. Store the employee credentials in AWS Systems Manager Parameter Store. Use AWS CloudFormation and the BatchGetSecretValue API to retrieve usernames and passwords from Parameter Store.
  2. Store the employee credentials in AWS Secrets Manager. Use AWS CloudFormation and AWS Batch with the BatchGetSecretValue API to retrieve the usernames and passwords from Secrets Manager.
  3. Store the employee credentials in AWS Systems Manager Parameter Store. Use AWS CloudFormation and AWS Batch with the BatchGetSecretValue API to retrieve the usernames and passwords from Parameter Store.
  4. Store the employee credentials in AWS Secrets Manager. Use AWS CloudFormation and the BatchGetSecretValue API to retrieve the usernames and passwords from Secrets Manager. Correct Answer

Key Takeaways

The question tests the distinction between managed secret storage and batch processing; the trap is confusing the 'Batch' in the API name with the AWS Batch service, which adds significant overhead.

AWS Secrets Manager is the correct service for securely managing employee credentials compared to Parameter Store. Using CloudFormation with the native BatchGetSecretValue API minimizes operational overhead by avoiding unnecessary compute services like AWS Batch.

Common mistake: Candidates often select options involving AWS Batch because they misinterpret the 'BatchGetSecretValue' API name as requiring the AWS Batch service, failing to realize it is a direct Secrets Manager API call.

Expert Analysis

Why the Answer Is Correct

The correct solution is D because AWS Secrets Manager is purpose-built for secrets management, offering automatic rotation and encryption out-of-the-box, unlike Systems Manager Parameter Store which requires more manual configuration for security. The BatchGetSecretValue API is a native feature of Secrets Manager that allows retrieving multiple secrets in one call, and when combined with AWS CloudFormation for infrastructure-as-code deployment, it provides the least operational overhead.

Why the Other Options Are Wrong

Options A and C use Parameter Store, which is less secure for passwords and lacks native rotation capabilities, increasing operational burden. Options B and C incorrectly include AWS Batch; AWS Batch is a compute service for running containerized jobs, not a mechanism for API calls within an application or CloudFormation template, thus adding unnecessary complexity and cost.

Community Comment Notes

Community consensus strongly supports D, noting that "Option B unnecessarily introduces AWS Batch into the solution" (as JoeTromundo noted). Users clarified that "BatchGetSecretValue API is with Secrets Manager, not related to AWS Batch" (as FlyingHawk noted), emphasizing that the API name can be misleading but does not require the Batch service.

Official Reference

These links open the official vendor documentation in a new tab.

Exam Strategy

Always distinguish between API names and AWS services; 'Batch' in an API name does not imply the need for the AWS Batch compute service. For credential storage, prefer Secrets Manager over Parameter Store when rotation and high-security standards are required.

Frequently Asked Questions

Is BatchGetSecretValue part of AWS Batch?

No, it is a native API call within AWS Secrets Manager. It does not require the AWS Batch compute service.

Why not use Parameter Store for passwords?

Parameter Store is designed for configuration data. Secrets Manager offers native encryption, rotation, and auditing specifically for sensitive secrets like passwords.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 4 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 4

  1. JoeTromundo 👍 7 Answered D
    Option D is similar to option B, but option B unnecessarily introduces AWS Batch into the solution. AWS Batch is designed for executing batch jobs and is not required for the use case of retrieving secrets in a web application. This adds complexity and overhead without benefit.
  2. spoved 👍 3 Answered D
    https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_BatchGetSecretValue.html
  3. FlyingHawk 👍 1 Answered D
    BatchGetSecretValue API is with Secrets Manager, not related to AWS Batch, it allows you to retrieve 1 to 20 secrets via a single API call. https://aws.amazon.com/blogs/security/how-to-use-the-batchgetsecretsvalue-api-to-improve-your-client-side-applications-with-aws-secrets-manager/
  4. viejito 👍 1
    respuesta correcta D : La opción D proporciona una solución adecuada y segura para gestionar y recuperar secretos, con un enfoque en la menor sobrecarga operativa posible al utilizar AWS Secrets Manager junto con la API correcta y la integración con AWS CloudFormation.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide