Discuss Amazon DVA-C02 Exam Topic 3 Question 62

A company has an existing application that has hardcoded database credentials A developer needs to modify the existing application The application is deployed in two AWS Regions with an active-passive failover configuration to meet company's disaster recovery strategy

The developer needs a solution to store the credentials outside the code. The solution must comply With the company's disaster recovery strategy

Which solution Will meet these requirements in the MOST secure way?

AStore the credentials in AWS Secrets Manager in the primary Region. Enable secret replication to the secondary Region Update the application to use the Amazon Resource Name (ARN) based on the Region.

BStore credentials in AWS Systems Manager Parameter Store in the primary Region. Enable parameter replication to the secondary Region. Update the application to use the Amazon Resource Name (ARN) based on the Region.

CStore credentials in a config file. Upload the config file to an S3 bucket in me primary Region. Enable Cross-Region Replication (CRR) to an S3 bucket in the secondary region. Update the application to access the config file from the S3 bucket based on the Region.

DStore credentials in a config file. Upload the config file to an Amazon Elastic File System (Amazon EFS) file system. Update the application to use the Amazon EFS file system Regional endpoints to access the config file in the primary and secondary Regions.

Suggested Answer: A

AWS Secrets Manager is a service that allows you to store and manage secrets, such as database credentials, API keys, and passwords, in a secure and centralized way.It also provides features such as automatic secret rotation, auditing, and monitoring1. By using AWS Secrets Manager, you can avoid hardcoding credentials in your code, which is a bad security practice and makes it difficult to update them.You can also replicate your secrets to another Region, which is useful for disaster recovery purposes2. To access your secrets from your application, you can use the ARN of the secret, which is a unique identifier that includes the Region name.This way, your application can use the appropriate secret based on the Region where it is deployed3.

AWS Secrets Manager

Replicating and sharing secrets

Using your own encryption keys

Get Premium DVA-C02 Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

19 comments · newest first

Matteo Rodriguez 10 days ago

Going with A since the tricky part is cross-region secret replication and region-specific ARNs.

Ankit Gupta 40 minutes ago

↳ replying to Matteo Rodriguez

If both options use region-based ARNs, why is A more secure for DR than B?

Meghan 2 months ago

Right, we need to prioritize security in our solutions.

Paulina 3 months ago

Exactly, A or B are the way to go for security.

Lili 3 months ago

D seems risky too. EFS might not be the best choice for credentials.

Lakeesha 3 months ago

I feel like C is less secure. S3 isn't meant for sensitive data.

Justine 3 months ago

But A has more features for managing secrets.

German 3 months ago

Option B is good too. Parameter Store is simpler and still secure.

Meghan 3 months ago

I agree, A is secure and supports replication.

Felicidad 4 months ago

I think option A is the best. Secrets Manager is designed for this.

Lenita 4 months ago

I’m surprised they even considered EFS for this. Doesn’t make sense.

Kris 4 months ago

Wait, why would anyone use a config file? Seems risky!

Adrianna 4 months ago

Parameter Store works too, but not as secure as Secrets Manager.

Beckie 6 months ago

I agree, Secrets Manager is designed for this!

Cassi 6 months ago

Option A is the best choice for security and compliance.

Leslie 7 months ago

I vaguely recall that using ARNs for region-specific access is important. So, options A and B seem to align with that requirement, but I’m leaning towards A for the added security features.

Isadora 7 months ago

I practiced a similar question where we had to choose between S3 and EFS for storing config files. I think options C and D might not be as secure since they involve config files, which can be less protected.

Ligia 7 months ago

I'm not entirely sure, but I think AWS Systems Manager Parameter Store is also a viable option. Option B might work, but I feel like it doesn't have the same level of security as Secrets Manager.

Veta 7 months ago

I remember we discussed using AWS Secrets Manager for storing sensitive information securely. It seems like option A could be the best choice since it supports replication.

Amazon DVA-C02 Exam - Topic 3 Question 62 Discussion