Discuss Amazon DVA-C02 Exam Topic 2 Question 57

A healthcare company is developing a multi-tier web application to manage patient records that are in an Amazon Aurora PostgreSQL database cluster. The company stores the application code in a Git repository and deploys the code to Amazon EC2 instances.

The application must comply with security policies and follow the principle of least privilege. The company must securely manage database credentials and API keys within the application code. The company must have the ability to rotate encryption keys on demand.

Which solution will meet these requirements?

AStore database credentials and API keys in AWS Secrets Manager. Use AWS managed AWS KMS keys. Set up automatic key rotation. Use the AWS SDK to retrieve secrets.

BStore the database credentials and API keys in AWS Secrets Manager. Use customer managed AWS KMS keys. Set up automatic key rotation. Create a key policy in the application to retrieve secrets by using the AWS SDK.

CStore the database credentials in the application code. Separate credentials by using environment-specific branches that have restricted access to the code repositories.

DStore the database credentials and API keys as parameters in AWS Systems Manager Parameter Store. Encrypt the credentials and API keys with AWS managed AWS KMS keys. Use the AWS SDK to retrieve secrets.

Suggested Answer: A

Requirement Summary:

Multi-tier app on EC2 + Aurora PostgreSQL

Must comply with least privilege and security policies

Need to manage credentials and API keys securely

Must support key rotation on demand

Evaluate Options:

A . Secrets Manager + AWS managed KMS keys

Best practice for secure secret storage

Supports auto rotation

Uses AWS SDK to fetch at runtime (secure, avoids hardcoding)

AWS managed keys are rotated automatically and easier to manage

B . Secrets Manager + customer managed keys

Also valid, but adds complexity

Since the question asks for LEAST development effort, AWS-managed keys are preferred

C . Store secrets in code

Violates all security best practices

D . Use SSM Parameter Store + AWS managed keys

Possible, but Secrets Manager is preferred when rotation is needed

Parameter Store does not natively rotate secrets

Secrets Manager: https://docs.aws.amazon.com/secretsmanager/latest/userguide/intro.html

Automatic key rotation: https://docs.aws.amazon.com/kms/latest/developerguide/rotate-keys.html

Best practices for secret management: https://docs.aws.amazon.com/secretsmanager/latest/userguide/best-practices.html

Get Premium DVA-C02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

28 comments · newest first

Audry 8 months ago

Option D sounds good too. Parameter Store is reliable for secrets.

Kirk 8 months ago

Option C is risky. Hardcoding credentials is a bad practice.

Freeman 8 months ago

I prefer option B. Customer managed keys give more control.

Cassi 8 months ago

I think option A is the best. Secrets Manager is secure.

Bernardo 9 months ago

A and D both look good, but A has that automatic key rotation!

Arlene 9 months ago

Surprised that D is even an option, feels less secure.

Deonna 9 months ago

I think B is better for more control over KMS keys.

Albert 9 months ago

Secrets Manager is the way to go. Rotating keys automatically is a game-changer.

Izetta 9 months ago

Option D looks good, but using AWS managed keys is not as flexible as customer-managed keys.

Jesusita 9 months ago

Haha, Option C? Storing credentials in the code? That's a big no-no!

Merilyn 10 months ago

I vaguely remember that AWS Systems Manager Parameter Store can also be used for storing secrets, but I'm not clear on how it compares to Secrets Manager in terms of security features.

Brigette 10 months ago

I feel like option C is definitely not the right choice since storing credentials in application code goes against best practices, but I can't recall why exactly.

Andra 10 months ago

Option A seems solid, using Secrets Manager is a good move.

Erick 10 months ago

I agree, Option B is the way to go. Separating credentials by environment is a security risk.

Fletcher 10 months ago

I think option A sounds familiar because it mentions using the AWS SDK to retrieve secrets, which we practiced in a similar question about securing API keys.

Lemuel 11 months ago

Option B seems like the most secure solution. Rotating encryption keys is a must-have.

Glen 11 months ago

Storing creds in code? That's a big no-no! (C is risky)

Jacklyn 11 months ago

I remember we discussed the importance of using AWS Secrets Manager for managing sensitive information, but I'm not sure if we covered the differences between managed and customer managed KMS keys.

Evangelina 11 months ago

The principle of least privilege is key here. I like how options A and B use the AWS SDK to retrieve secrets securely.

Eileen 11 months ago

I'm a bit confused about the difference between managed and customer-managed keys. I'll need to research that more before deciding.

Simona 12 months ago

Automatic key rotation is a must-have for compliance. I think option A or B would be the best approach here.

Craig 12 months ago

Hmm, storing credentials in the code doesn't seem very secure. I'm leaning towards one of the AWS services like Secrets Manager or Parameter Store.

Jutta 12 months ago

This looks like a tricky security question. I'll need to carefully consider the requirements and the options presented.

Terrilyn 7 months ago

↳ replying to Jutta

I agree with Nadine. A covers all the security bases well.

Kristel 7 months ago

↳ replying to Jutta

D is interesting, but I prefer using Secrets Manager for better security.

Telma 7 months ago

↳ replying to Jutta

C seems risky. Storing credentials in code is a bad practice.

Mila 7 months ago

↳ replying to Jutta

I’m leaning towards B. Customer managed keys give more control.

Nadine 7 months ago

↳ replying to Jutta

This is definitely a tricky one. I think A is the safest choice.

Amazon DVA-C02 Exam - Topic 2 Question 57 Discussion