How would you implement zero-downtime secrets rotation?

WHAT IT TESTS: rotating database credentials without connection drops or restarts. ANSWER OUTLINE: first, inventory secrets and document how each service caches or reloads them; second, baseline monitoring for auth failures and connection metrics; third, dual-phase rotation where new and old secrets overlap during cutover, updating apps to the new secret before revoking old; fourth, practice in staging and keep rollback procedures. RED FLAG: an immediate invalidate-and-restart approach that ignores in-memory caching and shared dependencies.