Discuss Amazon DVA-C02 Exam Topic 2 Question 14

A company notices that credentials that the company uses to connect to an external software as a service (SaaS) vendor are stored in a configuration file as plaintext.

The developer needs to secure the API credentials and enforce automatic credentials rotation on a quarterly basis.

Which solution will meet these requirements MOST securely?

AUse AWS Key Management Service (AWS KMS) to encrypt the configuration file. Decrypt the configuration file when users make API calls to the SaaS vendor. Enable rotation.

BRetrieve temporary credentials from AWS Security Token Service (AWS STS) every 15 minutes. Use the temporary credentials when users make API calls to the SaaS vendor.

CStore the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access.

DStore the credentials in AWS Systems Manager Parameter Store and enable rotation. Retrieve the credentials when users make API calls to the SaaS vendor.

Suggested Answer: C

Store the credentials in AWS Secrets Manager and enable rotation. Configure the API to have Secrets Manager access. This is correct. This solution will meet the requirements most securely, because it uses a service that is designed to store and manage secrets such as API credentials.AWS Secrets Manager helps you protect access to your applications, services, and IT resources by enabling you to rotate, manage, and retrieve secrets throughout their lifecycle1.You can store secrets such as passwords, database strings, API keys, and license codes as encrypted values2.You can also configure automatic rotation of your secrets on a schedule that you specify3.You can use the AWS SDK or CLI to retrieve secrets from Secrets Manager when you need them4. This way, you can avoid storing credentials in plaintext files or hardcoding them in your code.

Get Premium DVA-C02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

16 comments · newest first

Brock 11 months ago

D is a solid option too, but C has rotation built-in.

Shonda 11 months ago

Surprised that people still store creds in plaintext!

Angelica 11 months ago

A seems a bit outdated, isn't it?

Quentin 12 months ago

I think B is more secure with temporary credentials.

Kristeen 12 months ago

Option C is the best choice for secure credential management.

Antonette 1 year ago

I vaguely remember a practice question about using temporary credentials with AWS STS. That could be a good approach, but does it really meet the rotation requirement?

Izetta 1 year ago

I’m a bit confused about the difference between Secrets Manager and Parameter Store. I feel like both could work, but I need to recall which one is better for rotation.

Ammie 1 year ago

I think using AWS Secrets Manager sounds familiar; it seems like a solid choice for securely storing and rotating credentials.

Corinne 1 year ago

I remember we discussed the importance of not storing credentials in plaintext, but I'm not sure if KMS is the best option for automatic rotation.

Amber 1 year ago

Option B with temporary credentials from AWS STS sounds interesting, but I'm not sure if that's the most secure approach in this case. I'll need to think through the implications of that approach more carefully.

Erick 1 year ago

Hmm, I'm a bit unsure about this one. I'm trying to weigh the pros and cons of the different options. I think I need to review the AWS services in more detail to make sure I understand the differences between them.

Arminda 1 year ago

This looks like a straightforward security question. I'd go with option C - storing the credentials in AWS Secrets Manager and enabling rotation. That seems like the most secure and automated solution.

Carri 1 year ago

I'm pretty confident that option C is the way to go here. Storing the credentials in a secure service like AWS Secrets Manager and automating the rotation is the best way to meet the requirements while maintaining security.

Cecil 1 year ago

Okay, I've got a strategy here. The key clues are the lack of fast-forward and download options. That suggests the recording is of a secure session, so I'm going to go with option A.

Jaclyn 1 year ago

Okay, I think I've got this. "Move-in" must refer to the time when guests are expected to arrive and check into their rooms. That makes the most sense based on the options provided.

Thurman 1 year ago

Whew, this is a tough one. I'm a bit unsure about the different relationship types and how they would work here. I'll need to review the material on object relationships carefully and maybe even ask the instructor for some clarification before attempting this.

Amazon DVA-C02 Exam - Topic 2 Question 14 Discussion