A security engineer is developing a Java application on Amazon EC2 that connects to an Amazon RDS database using a user name and password. The engineer needs to protect the credentials and minimize downtime during password rotation. Which combination of actions will meet these requirements? (Choose two.)

AWS Secrets Manager is designed for managing, retrieving, and rotating database credentials, API keys, and other secrets. Enabling automatic credential rotation in Secrets Manager (first correct option) directly addresses the requirement to protect credentials and minimize downtime during password rotation. Secrets Manager can automatically rotate credentials for supported databases like Amazon RDS without requiring application changes for the rotation itself. To handle the updated credentials seamlessly, the application needs to be able to retrieve them. Modifying the Java application to catch connection failures and retrieve updated credentials from AWS Secrets Manager (second correct option) ensures that when a rotation occurs, the application can dynamically fetch the new credentials, minimizing downtime. The EC2 instance role must have permissions to access Secrets Manager for this to work. Storing credentials in S3 or Systems Manager Parameter Store without automatic rotation would require manual intervention or custom solutions for rotation, which increases operational overhead and potential downtime. A scheduled job in Systems Manager Parameter Store that requires a restart is not ideal for minimizing downtime.