Amazon Exam SCS-C01 Topic 2 Question 55 Discussion

Actual exam question for Amazon's SCS-C01 exam

Question #: 55
Topic #: 2

A company has a relational database workload that runs on Amazon Aurora MySQL. According to new compliance standards the company must rotate all database credentials every 30 days. The company needs a solution that maximizes security and minimizes development effort.

Which solution will meet these requirements?

AStore the database credentials in AWS Secrets Manager. Configure automatic credential rotation tor every 30 days.

BStore the database credentials in AWS Systems Manager Parameter Store. Create an AWS Lambda function to rotate the credentials every 30 days.

CStore the database credentials in an environment file or in a configuration file. Modify the credentials every 30 days.

DStore the database credentials in an environment file or in a configuration file. Create an AWS Lambda function to rotate the credentials every 30 days.

Show Suggested Answer

Suggested Answer: A

To rotate database credentials every 30 days, the most secure and efficient solution is to store the database credentials in AWS Secrets Manager and configure automatic credential rotation for every 30 days. Secrets Manager can handle the rotation of the credentials in both the secret and the database, and it can use AWS KMS to encrypt the credentials. Option B is incorrect because it requires creating a custom Lambda function to rotate the credentials, which is more effort than using Secrets Manager. Option C is incorrect because it stores the database credentials in an environment file or a configuration file, which is less secure than using Secrets Manager. Option D is incorrect because it combines the drawbacks of option B and option C. Verified Reference:

https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html

https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotate-secrets_turn-on-for-other.html

by Georgene at Mar 05, 2024, 12:12 AM

Limited Time Offer

25%

Off

Get Premium SCS-C01 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Telma

12 months ago

I think option B is a good compromise - using AWS Systems Manager Parameter Store and setting up a Lambda function for rotation.

upvoted 0 times

...

Jamey

12 months ago

That could work, but it's not as secure as using AWS Secrets Manager. Compliance standards require a higher level of security.

upvoted 0 times

...

Hubert

12 months ago

But wouldn't it be easier to just store the credentials in an environment file and modify them manually every 30 days?

upvoted 0 times

...

Brittani

12 months ago

I agree with Jamey. Storing credentials in AWS Secrets Manager provides better security and automating the rotation saves development effort.

upvoted 0 times

...

Jamey

12 months ago

I think the best solution would be to store the database credentials in AWS Secrets Manager and configure automatic rotation.

upvoted 0 times

...

Nu

1 years ago

B: That's a good point. Automation can definitely help reduce the risk of credentials being compromised.

upvoted 0 times

...

Shaquana

1 years ago

A: But wouldn't automating the rotation process with AWS Secrets Manager be more secure and less prone to human error?

upvoted 0 times

...

Twana

1 years ago

D: I think option B could also work well. Using AWS Systems Manager Parameter Store and creating a Lambda function for rotation could be efficient.

upvoted 0 times

...

Sabine

1 years ago

C: I'm not sure, wouldn't it be easier to just store the credentials in an environment file and manually update them every 30 days?

upvoted 0 times

...

Marta

1 years ago

B: I agree, option A seems like the most straightforward solution for meeting the compliance standards.

upvoted 0 times

...

Shawnda

1 years ago

A: I think option A is the best solution. Storing the credentials in AWS Secrets Manager and configuring automatic rotation is secure and requires minimal development effort.

upvoted 0 times

...

Mabel

1 years ago

Yeah, that's what I was thinking too. Secrets Manager is built for this kind of thing, so it's probably the lowest-effort solution. Plus, it has the advantage of being super secure.

upvoted 0 times

...

Glory

1 years ago

Agreed. I'm leaning towards option A - storing the credentials in Secrets Manager and letting it handle the rotation automatically. That seems like the most hands-off approach.

upvoted 0 times

Caprice

1 years ago

Let's go with Secrets Manager then. It seems like the most secure and efficient option.

upvoted 0 times

...

Leah

1 years ago

Exactly, we want to minimize human error as much as possible.

upvoted 0 times

...

Kimberlie

1 years ago

I see your point. Automation is key when it comes to security and compliance.

upvoted 0 times

...

Luisa

1 years ago

That could work too, but I think Secrets Manager provides a more seamless solution.

upvoted 0 times

...

Tawna

1 years ago

But what about using Systems Manager Parameter Store with a Lambda function? Wouldn't that work just as well?

upvoted 0 times

...

Horace

1 years ago

I agree, it would save us a lot of manual effort in rotating the credentials.

upvoted 0 times

...

Lynda

1 years ago

Option A sounds like the best choice. Let Secrets Manager handle the rotation automatically.

upvoted 0 times

...

Marvel

1 years ago

I hear you, Kirk. But this is a pretty standard requirement these days. We've got to take security seriously, even if it's a hassle. I think the key is finding the solution that's both secure and easy to implement.

upvoted 0 times

...

Kirk

1 years ago

Ugh, this question about rotating database credentials is a real pain. I hate having to deal with compliance and security requirements like this. Why can't they just let us use the same credentials forever?

upvoted 0 times

...