Practice exam questions with detailed explanations for AWS Secrets Manager
What is the maximum size of a secret in AWS Secrets Manager?
Correct Answer: B) 64KB
AWS Secrets Manager supports secrets up to 64KB in size. This limit applies to the entire secret value including any JSON structure.
Which AWS service is used for automatic secret rotation in Secrets Manager?
Correct Answer: A) AWS Lambda
Lambda functions handle the rotation logic for secrets. AWS provides pre-built rotation functions for RDS, DocumentDB, and Redshift, or you can create custom functions.
How many versions of a secret can be stored in Secrets Manager?
Correct Answer: B) 100
Secrets Manager can store up to 100 versions of a secret. Older versions are automatically deprecated but retained for recovery purposes.
Which encryption service is used by Secrets Manager to encrypt secrets at rest?
Correct Answer: A) AWS KMS
All secrets are encrypted using AWS Key Management Service (KMS). You can use AWS-managed keys or customer-managed keys for encryption.
What are the four phases of secret rotation in Secrets Manager?
Correct Answer: B) Create, Set, Test, Finish
The four standard rotation phases are: createSecret (generate new credentials), setSecret (update the service), testSecret (validate new credentials), and finishSecret (mark as current).
Which API call is used to retrieve a secret value from Secrets Manager?
Correct Answer: B) GetSecretValue
GetSecretValue retrieves the actual secret value. DescribeSecret only returns metadata without the secret value itself.
What is the maximum number of secrets per region in Secrets Manager?
Correct Answer: C) 500,000
You can store up to 500,000 secrets per region. This is a service quota that can be increased by contacting AWS Support.
Which feature allows cross-account access to secrets in Secrets Manager?
Correct Answer: B) Resource-based policies
Resource-based policies attached to secrets enable cross-account access. Both the resource policy and IAM permissions in the accessing account are required.
For Secrets Manager questions, remember: automatic rotation is only available for RDS, DocumentDB, and Redshift. All secrets are encrypted with KMS, and the maximum secret size is 64KB. Cross-account access requires resource-based policies.