Amazon DVA-C02 Exam - Topic 1 Question 34 Discussion

Actual exam question for Amazon's DVA-C02 exam

Question #: 34
Topic #: 1

A company runs a payment application on Amazon EC2 instances behind an Application Load Balance The EC2 instances run in an Auto Scaling group across multiple Availability Zones The application needs to retrieve application secrets during the application startup and export the secrets as environment variables These secrets must be encrypted at rest and need to be rotated every month.

Which solution will meet these requirements with the LEAST development effort?

ASave the secrets in a text file and store the text file in Amazon S3 Provision a customer managed key Use the key for secret encryption in Amazon S3 Read the contents of the text file and read the export as environment variables Configure S3 Object Lambda to rotate the text file every month

BSave the secrets as strings in AWS Systems Manager Parameter Store and use the default AWS Key Management Service (AWS KMS) key Configure an Amazon EC2 user data script to retrieve the secrets during the startup and export as environment variables Configure an AWS Lambda function to rotate the secrets in Parameter Store every month.

CSave the secrets as base64 encoded environment variables in the application properties. Retrieve the secrets during the application startup. Reference the secrets in the application code. Write a script to rotate the secrets saved as environment variables.

DStore the secrets in AWS Secrets Manager Provision a new customer master key Use the key to encrypt the secrets Enable automatic rotation Configure an Amazon EC2 user data script to programmatically retrieve the secrets during the startup and export as environment variables

Show Suggested Answer

Suggested Answer: D

AWS Secrets Manager:Built for managing secrets, providing encryption, automatic rotation, and access control.

Customer Master Key (CMK):Provides an extra layer of control over encryption through AWS KMS.

Automatic Rotation:Enhances security by regularly changing the secret.

User Data Script:Allows secrets retrieval at instance startup and sets them as environment variables for seamless use within the application.

AWS Secrets Manager Documentation:https://docs.aws.amazon.com/secretsmanager/

AWS KMS Documentation:https://docs.aws.amazon.com/kms/

User Data for EC2 Instances:https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/user-data.html

by Jeannetta at Aug 28, 2024, 02:50 AM

Limited Time Offer

25%

Off

Get Premium DVA-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Melynda

5 months ago

Parameter Store is solid, but I’d still prefer Secrets Manager for sensitive data.

upvoted 0 times

...

Annita

5 months ago

Wait, can you really rotate secrets in S3 like that? Sounds sketchy.

upvoted 0 times

...

Jacinta

5 months ago

I think A is way too complicated for what it needs to do.

upvoted 0 times

...

Ty

5 months ago

I disagree, D looks more secure with automatic rotation.

upvoted 0 times

...

Laurel

6 months ago

Option B seems like the easiest way to manage secrets with minimal effort.

upvoted 0 times

...

Daniela

6 months ago

I vaguely remember that using environment variables directly isn't recommended for security reasons, so I think options A and C might not be ideal.

upvoted 0 times

...

Mari

6 months ago

I practiced a similar question where we had to choose between S3 and Secrets Manager. I feel like Secrets Manager is the way to go here, but I’m not completely confident.

upvoted 0 times

...

Darnell

6 months ago

I think option B sounds familiar; using Systems Manager Parameter Store seems like a simpler way to handle secrets, but I can't recall if it supports automatic rotation.

upvoted 0 times

...

Rima

6 months ago

I remember we discussed using AWS Secrets Manager for managing secrets, but I'm not sure if it was the best option for this scenario.

upvoted 0 times

...

Dana

6 months ago

I'm not sure about Option A with S3 and Object Lambda. That seems a bit more complex than the other options, and I'm not sure it's the "least development effort" solution.

upvoted 0 times

...

Carmen

6 months ago

I'm leaning towards Option D with Secrets Manager. The automatic rotation feature is really appealing, and the user data script to export the secrets as environment variables is a nice way to handle that requirement.

upvoted 0 times

...

Ria

6 months ago

Option B seems like the simplest approach to me. Using Systems Manager Parameter Store and the default KMS key should be straightforward, and the user data script to retrieve the secrets during startup is a nice touch.

upvoted 0 times

...

Eugene

6 months ago

Hmm, I'm a bit confused by all the different AWS services mentioned. I'll need to carefully read through the question and options to make sure I understand the differences between them.

upvoted 0 times

...

Sommer

7 months ago

This looks like a tricky question, but I think I can tackle it. The key is to find the solution that requires the least development effort while still meeting all the requirements.

upvoted 0 times

...

Elizabeth

7 months ago

Okay, let me see here. If there's no dimension applied, it should default to the most common dimensions. I'm going to go with C - Hour or Days.

upvoted 0 times

...

Barrett

2 years ago

Lol, Option A with the S3 text file rotation sounds like something my grandpa would come up with. 'Back in my day, we used to rotate secrets by hand, uphill both ways!'

upvoted 0 times

...

Hollis

2 years ago

Option D with Secrets Manager looks good, but I'm not a fan of provisioning a new customer master key. Why not just use the default AWS KMS key like in Option B? Keeps things simple.

upvoted 0 times

Virgilio

2 years ago

I see your point. It really depends on how much control you want over the encryption and rotation process.

upvoted 0 times

...

Lon

2 years ago

True, but with Secrets Manager, you don't have to worry about managing the rotation process yourself.

upvoted 0 times

...

Vanda

2 years ago

But using the default AWS KMS key in Option B is simpler and requires less setup.

upvoted 0 times

...

Gladis

2 years ago

Option D with Secrets Manager is more secure though. It automatically rotates the secrets for you.

upvoted 0 times

...

Julie

2 years ago

I'm not sure why anyone would want to manually rotate secrets as environment variables (Option C). That sounds like a maintenance nightmare waiting to happen. Option B is clearly the best choice here.

upvoted 0 times

...

Roosevelt

2 years ago

I agree, Option B is the way to go. It minimizes the development effort and still meets all the requirements. Rotating the secrets in Parameter Store is a nice and convenient feature.

upvoted 0 times

Avery

2 years ago

Using AWS Systems Manager Parameter Store and AWS KMS key for encryption is a smart move. Option B is definitely the way to go.

upvoted 0 times

...

Dottie

2 years ago

I agree, Option B seems like the most efficient solution for this scenario.

upvoted 0 times

...

Alease

2 years ago

I think Option B is the best choice. It's simple and meets all the requirements.

upvoted 0 times

...

Ollie

2 years ago

Option B seems like the easiest solution. Using Parameter Store and the default AWS KMS key is a straightforward way to manage the secrets, and the user data script and Lambda function for rotation are simple to set up.

upvoted 0 times