Examkin

Secrets Management and Parameter Store

45 questions

All types45Multiple choice21Multiple select24
Question 1Question →

A developer is deploying a microservice on Amazon ECS using AWS Fargate that connects to an Amazon Aurora PostgreSQL database. The application must retrieve a database endpoint (non-sensitive configuration) and a database password (sensitive credential). The database password must be automatically rotated every 30 days. The microservice handles a very high volume of requests, so the developer must design a solution that prevents database connection failures after rotation, avoids API throttling errors, and minimizes costs. Which approach should the developer take to retrieve and manage these configurations?

Show answer & explanation

Answer: Store the database endpoint in Systems Manager Parameter Store as a standard parameter and the database password in AWS Secrets Manager with automatic rotation. Retrieve both values in the microservice code using the AWS SDK, cache them locally in memory with a Time-to-Live (TTL), and re-fetch them from the respective AWS services when the TTL expires.

Answer

Store the database endpoint in Systems Manager Parameter Store as a standard parameter and the database password in AWS Secrets Manager with automatic rotation. Retrieve both values in the microservice code using the AWS SDK, cache them locally in memory with a Time-to-Live (TTL), and re-fetch them from the respective AWS services when the TTL expires.
The correct strategy combines Systems Manager Parameter Store for non-sensitive configurations and AWS Secrets Manager for sensitive credentials that need automatic rotation. Under high-throughput environments, fetching credentials on every request will cause API throttling. Caching values locally with a Time-to-Live (TTL) ensures low latency and avoids API rate limiting, while the TTL expiration guarantees that the microservice eventually fetches the new password after an automatic rotation, avoiding database connection issues.

Step-by-Step Solution

1
Determine the appropriate storage service for each configuration type.
The database endpoint is non-sensitive configuration data, which is most cost-effective to store in Systems Manager Parameter Store. The database password is a sensitive credential requiring automatic rotation, making AWS Secrets Manager the correct choice.
Parameter Store does not charge for standard parameters, while Secrets Manager charges $0.40 per secret per month but supports automatic rotation natively.
2
Configure the rotation mechanism for the database password.
Enable automatic rotation in Secrets Manager, which uses an AWS Lambda function to update the database password in both Secrets Manager and the Aurora database.
This ensures the credentials remain secure without manual intervention.
3
Implement a caching strategy inside the microservice application code.
Use the AWS SDK to retrieve the parameters, and cache the values in memory with a reasonable Time-to-Live (TTL). When the TTL expires, the microservice makes a fresh call to the AWS APIs to refresh the cache.
Caching avoids API throttling (ProvisionedThroughputExceededException) and minimizes retrieval latency. The TTL ensures that warm containers periodically refresh their cached credentials, preventing connection failures after a rotation occurs.

Key Concept

Selecting and integrating AWS Secrets Manager and Systems Manager Parameter Store with caching to support credentials rotation in high-throughput applications.
Question 2Question →

A developer is deploying a containerized API to AWS App Runner. The application needs to retrieve credentials for a backend Amazon Aurora MySQL database, which must be rotated automatically every 45 days. Additionally, the application requires access to 50 non-sensitive configuration parameters, such as service endpoints and logging levels, which are updated frequently. The developer wants to implement a secure, cost-effective architecture.

Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda rotation function template.; Store the non-sensitive logging levels and service endpoints as standard parameters in AWS Systems Manager Parameter Store.

Answer

The correct combination is to store the database credentials in AWS Secrets Manager with built-in Lambda automatic rotation, and store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as standard parameters.
The correct solution uses AWS Secrets Manager for the database credentials because Secrets Manager natively supports automatic rotation using built-in Lambda templates. It uses AWS Systems Manager Parameter Store (standard parameters) for the non-sensitive parameters because standard parameters are free, ensuring the overall architecture is cost-effective.

Step-by-Step Solution

1
Analyze credential security and rotation requirements.
Identify that the Aurora database credentials require security and automated rotation every 45 days. AWS Secrets Manager is the optimal service here because it offers out-of-the-box rotation support using Lambda templates specifically integrated with RDS/Aurora.
Ensures credentials are secure and rotated without custom scripting overhead.
2
Analyze non-sensitive configuration requirements and cost constraints.
Identify that logging levels and service endpoints are non-sensitive and numerous (50 parameters). Storing them in AWS Systems Manager Parameter Store as standard parameters is free, satisfying the cost-efficiency constraint.
Minimizes unnecessary Secrets Manager charges for non-sensitive data.

Key Concept

Secrets Manager vs Systems Manager Parameter Store
Estimated Time:2m 0s
Question 3Question →

A developer is building a multi-region active-active web application deployed across `us-east-1` and `us-west-2` using AWS Lambda. The application must securely retrieve a database credential that requires automatic rotation every 3030 days, as well as a region-specific database connection endpoint URL that is non-sensitive. The solution must minimize cross-region latency for credential retrieval and optimize cost. Which combination of services and configuration should the developer use to meet these requirements?

Show answer & explanation

Answer: Store the database credential in AWS Secrets Manager in `us-east-1` with automatic rotation configured, and replicate the secret to `us-west-2`. Store the non-sensitive connection endpoint URL in AWS Systems Manager Parameter Store as a regional String parameter in each region.

Answer

Store the database credential in AWS Secrets Manager in `us-east-1` with automatic rotation configured, and replicate the secret to `us-west-2`. Store the non-sensitive connection endpoint URL in AWS Systems Manager Parameter Store as a regional String parameter in each region.
Storing the database credential in AWS Secrets Manager meets the requirement for automatic rotation, and replication to the secondary region ensures low-latency local access. Utilizing Systems Manager Parameter Store for the connection endpoint is cost-effective, and storing it as a regional parameter in each region eliminates cross-region latency.

Step-by-Step Solution

1
Analyze credential requirements
Database credentials require security, automatic rotation, and cross-region availability with minimum latency.
AWS Secrets Manager is designed for managing sensitive secrets, supporting automated rotation and built-in cross-region replication.
2
Analyze non-sensitive configuration requirements
The connection endpoint is region-specific, non-sensitive, and needs to be retrieved cost-effectively.
AWS Systems Manager Parameter Store is ideal and cost-effective for storing non-sensitive config parameters, and storing them as regional parameters avoids cross-region latency.
3
Assess IAM and replication configurations
Identify the solution that avoids custom replication code and hardcoded credentials.
Native Secrets Manager replication handles cross-region secret syncing automatically, and using Lambda execution roles avoids hardcoding credentials.

Key Concept

Selecting the correct secret and parameter management service based on sensitivity, replication, rotation, and cost constraints.
Estimated Time:2m 0s
Question 4Question →

A developer is configuring an application deployed on AWS App Runner in Account A. The application needs to retrieve database credentials to connect to an Amazon RDS database hosted in Account B. The database credentials must be rotated automatically every 30 days. Additionally, the application requires access to a public API endpoint URL that is non-sensitive and does not change. The developer wants to implement a secure, cost-effective parameter storage solution that allows cross-account access where necessary. Which combination of actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager in Account B, configure automatic rotation, and attach a resource-based policy to the secret that grants retrieve permissions to the App Runner instance role in Account A.; Store the public API endpoint URL in AWS Systems Manager Parameter Store in Account A as a Standard String parameter.

Answer

Store the database credentials in AWS Secrets Manager in Account B with a resource-based policy granting access to Account A, and store the public API endpoint URL in AWS Systems Manager Parameter Store in Account A as a Standard String parameter.
The correct options are to store the database credentials in AWS Secrets Manager in Account B with a resource-based policy, and store the public API endpoint URL in AWS Systems Manager Parameter Store in Account A. AWS Secrets Manager supports automatic rotation and allows direct cross-account access via resource-based policies. Systems Manager Parameter Store is a cost-effective choice for non-sensitive, static configurations since standard parameters have no storage costs.

Step-by-Step Solution

1
Evaluate credential storage and sharing requirements.
Database credentials need to be stored in Account B, rotated every 30 days, and accessed by Account A. AWS Secrets Manager supports automatic rotation and resource-based policies, which allow cross-account sharing directly.
This satisfies the security requirement for automatic rotation and cross-account access.
2
Evaluate non-sensitive configuration storage.
The public API endpoint URL is non-sensitive and static. AWS Systems Manager Parameter Store Standard parameters are ideal because they are free and do not require rotation.
This satisfies the cost-effectiveness requirement.
3
Configure permissions for Account A's App Runner service.
Attach a resource-based policy to the Secrets Manager secret in Account B, specifying the App Runner instance role ARN from Account A as the principal with 'secretsmanager:GetSecretValue' permissions.
This enables secure retrieval of the credentials without hardcoding them or setting up complex cross-account IAM role assumption.

Key Concept

Secrets Manager vs Parameter Store feature comparison, including rotation, pricing, and cross-account capabilities.
Question 5Question →

An organization hosts a critical multi-region web application on Amazon ECS Fargate across the us-east-1 and us-west-2 Regions. The application connects to an Amazon Aurora Global Database. A developer needs to design a secure solution to manage the database password. The password must be rotated every 30 days, and ECS tasks in both Regions must be able to retrieve the credentials locally with minimal latency. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager in the primary Region, configure automatic rotation using the built-in RDS rotation template, and replicate the secret to the secondary Region. In the ECS task definition, assign the permission to retrieve the secret to the ECS Task Execution Role, and reference the local Secrets Manager ARN in the container definition's environment variables (valueFrom).

Answer

Store the database credentials in AWS Secrets Manager in the primary Region, configure automatic rotation using the built-in RDS rotation template, and replicate the secret to the secondary Region. In the ECS task definition, assign the permission to retrieve the secret to the ECS Task Execution Role, and reference the local Secrets Manager ARN in the container definition's environment variables (valueFrom).
The correct solution leverages AWS Secrets Manager's native support for automatic rotation of database credentials using built-in AWS Lambda rotation templates. Replicating the secret to the secondary Region ensures that ECS Fargate tasks can retrieve the secret locally, minimizing latency. To inject secrets as environment variables during task startup, the ECS container agent retrieves the secret, which requires the necessary permissions to be attached to the ECS Task Execution Role, rather than the ECS Task Role.

Step-by-Step Solution

1
Identify the service that natively supports automatic credential rotation and multi-region replication.
AWS Secrets Manager supports automatic rotation for Amazon RDS/Aurora and cross-region replication, whereas Parameter Store lacks these native features.
Using Secrets Manager minimizes custom replication and rotation scripts, satisfying the low operational overhead requirement.
2
Determine how ECS tasks retrieve secrets during container startup.
ECS allows injecting secrets directly into environment variables using the valueFrom parameter in the container definition.
Injecting secrets directly prevents them from being exposed in the task definition plaintext or application logs.
3
Identify the correct IAM role needed for secret injection.
The ECS Task Execution Role is used by the ECS container agent to pull images and retrieve secrets, while the ECS Task Role is for application code API calls.
Granting permission to the Task Execution Role ensures the ECS agent can retrieve the secret from Secrets Manager to spin up the container successfully.

Key Concept

Database credential rotation, multi-region replication, and ECS task execution role permissions for secrets injection.
Estimated Time:2m 30s
Question 6Question →

A developer is deploying a microservices application to AWS App Runner. The application needs to retrieve two configuration settings:

1. Database credentials for an Amazon Aurora PostgreSQL database that must be rotated automatically every 30 days.
2. A public API endpoint URL for an external service that is non-sensitive and frequently accessed.

Which combination of actions should the developer perform to manage and retrieve these configurations securely and cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in AWS Lambda rotation function.; Store the external service endpoint URL in AWS Systems Manager Parameter Store as a String parameter.

Answer

The developer should store the database credentials in AWS Secrets Manager and configure automatic rotation, and store the non-sensitive external service endpoint URL in AWS Systems Manager Parameter Store as a String parameter.
AWS Secrets Manager is designed for storing database credentials securely and provides native support for RDS/Aurora automatic rotation via Lambda. AWS Systems Manager Parameter Store is the most cost-effective storage for non-sensitive configuration data like API endpoints, as standard parameters are free.

Step-by-Step Solution

1
Determine the appropriate storage service for the database credentials.
Identify AWS Secrets Manager as the best choice because it offers native integration with Amazon Aurora and built-in automatic credential rotation.
AWS Secrets Manager is specifically built for secrets requiring lifecycle management and rotation, reducing custom scripting effort.
2
Determine the appropriate storage service for the public API endpoint URL.
Identify AWS Systems Manager Parameter Store as the correct choice since the configuration is non-sensitive and does not require rotation.
Parameter Store standard parameters are free and ideal for non-sensitive application settings, optimizing costs.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on security features (like automatic rotation) and cost-efficiency.
Question 7Question →

A developer is configuring an AWS CodeBuild project that runs integration tests. These tests require credentials to access an Amazon RDS PostgreSQL database. The database credentials must be rotated automatically every 3030 days. How should the developer store and retrieve these credentials to meet the requirements with the least operational overhead?

Show answer & explanation

Answer: Store the credentials in AWS Secrets Manager, configure automatic rotation using the built-in AWS Lambda rotation template for Amazon RDS, and reference the secret in the CodeBuild project's buildspec file.

Answer

Store the credentials in AWS Secrets Manager, configure automatic rotation using the built-in AWS Lambda rotation template for Amazon RDS, and reference the secret in the CodeBuild project's buildspec file.
Storing the credentials in AWS Secrets Manager is the correct approach. Secrets Manager provides native integration with Amazon RDS, allowing automatic credential rotation using built-in Lambda templates without writing custom code. CodeBuild can securely fetch these credentials dynamically during the build run by referencing them in the buildspec file.

Step-by-Step Solution

1
Evaluate the requirement for automatic rotation of database credentials every 3030 days.
Identify that AWS Secrets Manager provides native, out-of-the-box support for rotating Amazon RDS credentials using built-in AWS Lambda templates.
Using native features minimizes custom code and operational overhead compared to manual or custom-coded solutions.
2
Compare Secrets Manager and Systems Manager Parameter Store for credential rotation.
Acknowledge that Parameter Store (even with SecureString parameters) lacks built-in automatic rotation templates for RDS, requiring custom Lambda functions and EventBridge rules.
This step eliminates options proposing Parameter Store due to the higher operational overhead requirement.
3
Integrate the secret retrieval into the AWS CodeBuild pipeline.
Reference the secret using Secrets Manager syntax in the buildspec file of the CodeBuild project.
This ensures the build environment retrieves the latest rotated credentials securely at runtime without exposing them in configuration logs or plaintext variables.

Key Concept

AWS Secrets Manager built-in rotation vs Systems Manager Parameter Store capabilities
Question 8Question →

A developer is configuring a machine learning pipeline in Amazon SageMaker. The pipeline needs to retrieve a personal access token (PAT) to pull training code from a private Git repository. This PAT must be rotated monthly and accessed by pipelines running across multiple AWS accounts in the same organization. Additionally, the pipeline needs to retrieve non-sensitive training hyperparameters (such as learning rate and batch size) that are only used within the local AWS account. How should the developer store these values to meet the requirements securely and cost-effectively?

Show answer & explanation

Answer: Store the private Git repository token in AWS Secrets Manager and attach a resource-based policy to the secret to allow cross-account access. Store the hyperparameters as String parameters in AWS Systems Manager Parameter Store.

Answer

Store the private Git repository token in AWS Secrets Manager and attach a resource-based policy to the secret to allow cross-account access. Store the hyperparameters as String parameters in AWS Systems Manager Parameter Store.
The correct answer correctly identifies that AWS Secrets Manager should be used for the private Git repository token because it natively supports resource-based policies for cross-account sharing and automatic rotation. It also correctly identifies that Systems Manager Parameter Store is the most cost-effective service for storing non-sensitive hyperparameters, avoiding unnecessary Secrets Manager costs.

Step-by-Step Solution

1
Analyze the requirements for the private Git repository token.
Identify that the token is sensitive, needs automatic monthly rotation, and requires cross-account access.
This determines the best security service to use based on features like resource-based policies and rotation.
2
Analyze the requirements for the hyperparameters.
Identify that the hyperparameters are non-sensitive configuration data, do not require rotation, and are only accessed locally.
This helps select the most cost-effective storage option for non-sensitive configurations.
3
Compare AWS Secrets Manager and Systems Manager Parameter Store features and cost.
AWS Secrets Manager is selected for the token because it supports resource-based policies for cross-account access and automatic rotation. Systems Manager Parameter Store is selected for the hyperparameters because standard parameters are free and suitable for non-sensitive data.
Ensures the solution is both secure and optimized for cost.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on rotation, cross-account access, and cost-efficiency.
Estimated Time:1m 30s
Question 9Question →

A developer is configuring a containerized application running in AWS Batch. The application requires access to two sensitive values: a database password for an Amazon Aurora PostgreSQL database that must be rotated every 30 days, and an API key for a partner service that is static and does not require rotation. The developer wants to minimize costs while maintaining high security.

Which actions should the developer take to configure the storage for these secrets? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and enable automatic rotation using the built-in AWS Lambda rotation template for Amazon Aurora.; Store the partner API key in AWS Systems Manager Parameter Store as a SecureString parameter.

Answer

Store the database password in AWS Secrets Manager with automatic rotation enabled, and store the partner API key in AWS Systems Manager Parameter Store as a SecureString parameter.
The database password requires automatic rotation, which is a native feature of AWS Secrets Manager. The partner API key is static and does not require rotation, making Systems Manager Parameter Store (SecureString) the most cost-effective and secure choice.

Step-by-Step Solution

1
Identify the rotation requirement for the database password.
Since the Aurora PostgreSQL database password requires automatic rotation every 30 days, AWS Secrets Manager should be selected because it natively supports automatic rotation via built-in AWS Lambda templates for RDS.
AWS Systems Manager Parameter Store does not support native automatic rotation.
2
Identify the rotation and cost requirements for the partner API key.
Since the partner API key is static, does not require rotation, and the goal is to minimize costs, AWS Systems Manager Parameter Store (specifically a SecureString parameter) should be selected.
AWS Secrets Manager charges a monthly fee per secret, making it less cost-effective than Parameter Store for static configurations, while SecureString parameters provide the same level of encryption.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation needs and cost efficiency.
Estimated Time:1m 0s
Question 10Question →

A developer is building a containerized microservice deployed on Amazon Elastic Container Service (Amazon ECS) using the AWS Fargate launch type. The microservice requires access to:

1. A sensitive API key for a third-party SaaS service that requires scheduled rotation every 3030 days.
2. A non-sensitive log level configuration setting (e.g., INFO, DEBUG) that varies between development and production environments.

Which combination of actions should the developer take to configure these parameters securely and cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the third-party API key in AWS Secrets Manager and configure an AWS Lambda function to handle the 3030-day rotation logic.; Store the log level configuration setting in AWS Systems Manager Parameter Store as a String parameter.

Answer

Store the third-party API key in AWS Secrets Manager and configure an AWS Lambda function to handle the 3030-day rotation logic, and store the log level configuration setting in AWS Systems Manager Parameter Store as a String parameter.
For the sensitive third-party API key, storing it in AWS Secrets Manager allows the developer to configure an AWS Lambda function to handle the required custom 3030-day rotation logic. For the non-sensitive log level configuration, AWS Systems Manager Parameter Store is a cost-effective and simple solution that avoids unnecessary Secrets Manager costs.

Step-by-Step Solution

1
Analyze secret rotation requirements
Identify that the third-party API key requires automated rotation every 3030 days, which is a native feature of AWS Secrets Manager using a custom AWS Lambda function.
Parameter Store does not offer built-in secret rotation schedules, making Secrets Manager the appropriate choice for the API key.
2
Analyze non-sensitive configuration requirements
Identify that the log level setting is non-sensitive and varies per environment, which maps perfectly to AWS Systems Manager Parameter Store String parameters.
Using Parameter Store for non-sensitive data is cost-effective (no cost for standard parameters) compared to AWS Secrets Manager.

Key Concept

Selecting between AWS Secrets Manager and AWS Systems Manager Parameter Store based on sensitivity and rotation requirements.
Question 11Question →

A developer is designing a serverless payment processing application running on AWS Lambda. The application must retrieve the following credentials and configuration settings securely:

1. A third-party API key that is manually rotated every 90 days and must be securely accessed by Lambda functions running in different AWS accounts.
2. A database credential for an Amazon RDS PostgreSQL database that requires automatic rotation every 30 days without causing application downtime.
3. Non-sensitive application configuration parameters (such as timeout limits and connection pool sizes) that must be stored hierarchically and retrieved at minimal cost.

Which of the following configuration options should the developer select to meet these requirements? (Select TWO).

Select all that apply

Show answer & explanation

Answer: Store the RDS database credentials and the third-party API key in AWS Secrets Manager, attaching a resource-based policy to the API key secret to grant read access to the Lambda functions in the other AWS accounts.; Store the non-sensitive configuration parameters as Standard parameters in AWS Systems Manager Parameter Store using hierarchical paths.

Answer

Store the database credentials and the third-party API key in AWS Secrets Manager, utilizing a resource-based policy for cross-account access to the API key, and store non-sensitive configuration parameters as Standard parameters in AWS Systems Manager Parameter Store.
The correct architecture leverages AWS Secrets Manager for secrets requiring automatic rotation or cross-account access via resource-based policies, and AWS Systems Manager Parameter Store for cost-effective hierarchical configuration storage. Database credentials require automatic rotation, which is a native feature of AWS Secrets Manager for Amazon RDS. The third-party API key needs cross-account access, which is supported in Secrets Manager using resource-based policies. Non-sensitive configurations are best stored as Standard parameters in Parameter Store, as they are free and support hierarchical paths.

Step-by-Step Solution

1
Analyze the database credential rotation requirement.
Identify that Amazon RDS database credentials require automatic rotation every 30 days.
AWS Secrets Manager natively supports automatic rotation of RDS credentials without custom Lambda code or downtime.
2
Analyze the third-party API key sharing requirement.
Identify that the API key needs to be securely shared cross-account.
AWS Secrets Manager supports resource-based policies, allowing direct cross-account access without assuming cross-account IAM roles, unlike Systems Manager Parameter Store.
3
Analyze the non-sensitive configuration storage requirement.
Identify that non-sensitive settings need hierarchical storage at minimal cost.
Systems Manager Parameter Store Standard parameters are free of charge, support hierarchical paths, and are the most cost-effective choice for non-sensitive data.

Key Concept

Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation, cross-account access capabilities, and cost efficiency.
Question 12Question →

A developer is configuring a database connection for a new application. The database credentials must be rotated automatically every 15 days, and the developer wants to use native integration with Amazon RDS to rotate them without writing custom rotation code. Which AWS service should the developer use to store the credentials?

Show answer & explanation

Answer: AWS Secrets Manager

Answer

AWS Secrets Manager
AWS Secrets Manager is designed for storing and managing secrets, offering built-in integration with Amazon RDS to automatically rotate database credentials without requiring custom code.

Step-by-Step Solution

1
Identify the requirement for automatic credential rotation every 15 days.
Automatic rotation is a native feature of AWS Secrets Manager but is not natively supported by Systems Manager Parameter Store.
Secrets Manager provides out-of-the-box rotation support for popular database services like Amazon RDS.
2
Evaluate the requirement for native RDS integration without writing custom rotation code.
AWS Secrets Manager provides built-in rotation templates for RDS, whereas other services would require writing custom rotation logic.
Using native RDS integration simplifies the operational overhead of rotation.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store features, specifically automatic rotation and database integration.
Estimated Time:45s
Question 13Question →

A developer is designing a serverless backend using AWS Lambda that connects to an Amazon RDS for PostgreSQL database. The application security policy requires that database passwords be rotated automatically every 30 days. Additionally, the Lambda function needs to retrieve non-sensitive configuration parameters, such as logging levels and external API endpoints. Which combination of actions should the developer take to implement these requirements securely and cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure the built-in automatic rotation for Amazon RDS.; Store the non-sensitive configuration parameters in AWS Systems Manager Parameter Store as Standard parameters.

Answer

Storing the database credentials in AWS Secrets Manager with built-in automatic rotation enabled, and storing the non-sensitive configurations in AWS Systems Manager Parameter Store as Standard parameters.
AWS Secrets Manager is designed for managing secrets such as database credentials and supports automated rotation out of the box, specifically with integrations for Amazon RDS. AWS Systems Manager Parameter Store is ideal for general, non-sensitive configuration parameters because Standard parameters are free, making it the most cost-effective choice for configurations that do not require rotation or encryption.

Step-by-Step Solution

1
Identify the storage and rotation requirements for the database credentials.
Database credentials are sensitive and require automatic rotation every 30 days. AWS Secrets Manager is the optimal service because it provides built-in rotation integration with Amazon RDS.
Parameter Store does not natively support automatic rotation, so using Parameter Store would require writing custom rotation logic.
2
Identify the storage and cost requirements for non-sensitive configurations.
Non-sensitive configurations (like logging levels) do not require rotation or encryption. Storing them in Parameter Store as Standard parameters is free and meets the cost-effectiveness requirement.
Storing non-sensitive config in Secrets Manager would incur unnecessary monthly costs per secret.

Key Concept

Distinguishing between AWS Secrets Manager and AWS Systems Manager Parameter Store features and cost profiles.
Question 14Question →

An application hosted on Amazon EC2 instances requires access to a database password that must be rotated every 30 days, as well as a non-sensitive external API endpoint URL that does not change. Which TWO of the following configurations should the developer use to manage these values securely and cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation.; Store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter.

Answer

Store the database password in AWS Secrets Manager and configure automatic rotation, and store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter.
The correct options are to store the database password in AWS Secrets Manager and configure automatic rotation, and store the API endpoint URL in Systems Manager Parameter Store as a Standard String parameter. This ensures sensitive passwords are encrypted and rotated automatically, while non-sensitive parameters are stored cost-effectively in Parameter Store without incurring extra charges.

Step-by-Step Solution

1
Analyze the requirements for the database password.
The database password is a sensitive credential and requires rotation every 30 days.
AWS Secrets Manager is the optimal service because it securely stores secrets and provides built-in rotation integration.
2
Analyze the requirements for the API endpoint URL.
The API endpoint URL is non-sensitive and static (does not change or rotate).
Systems Manager Parameter Store is the most cost-effective solution for non-sensitive configuration parameters.

Key Concept

Distinction between AWS Secrets Manager and Systems Manager Parameter Store
Estimated Time:1m 0s
Question 15Question →

A development team needs to store a collection of third-party API keys that will be accessed by several serverless applications. These keys must be encrypted at rest, but they do not require automatic rotation or cross-account access. The team wants a solution that minimizes storage and retrieval costs.

Which AWS service or feature should the developer select to store these API keys?

Show answer & explanation

Answer: Systems Manager Parameter Store using SecureString parameters

Answer

Systems Manager Parameter Store using SecureString parameters
Systems Manager Parameter Store using SecureString parameters is the correct choice because it provides secure, encrypted storage for configuration data and secrets at no additional cost for standard parameters. Since the API keys do not require automatic rotation or cross-account access, using Parameter Store is the most cost-effective and operationally efficient solution.

Step-by-Step Solution

1
Analyze the requirements for storing the third-party API keys.
The API keys must be encrypted at rest, accessed by multiple serverless applications, do not require automatic rotation, and the solution must minimize storage and retrieval costs.
Understanding the technical constraints helps in selecting the most cost-effective and secure AWS service.
2
Compare AWS Systems Manager Parameter Store and AWS Secrets Manager against the requirements.
Parameter Store (SecureString) offers free/cost-effective secure storage without automatic rotation. Secrets Manager supports automatic rotation but introduces a monthly cost per secret.
Both services support encryption, but Parameter Store is the more cost-effective choice for secrets that do not require rotation.
3
Select the correct service and parameter type.
Systems Manager Parameter Store using SecureString parameters satisfies both the security and cost-efficiency requirements.
Using SecureString parameters ensures the API keys are encrypted at rest using KMS while remaining cost-effective.

Key Concept

Selecting between Parameter Store and Secrets Manager based on rotation requirements and cost efficiency.
Estimated Time:1m 0s
Question 16Question →

A developer is designing a microservice application deployed on Amazon Elastic Kubernetes Service (Amazon EKS). The microservice requires access to two types of data: database credentials for an Amazon RDS for PostgreSQL instance that must be automatically rotated every 30 days, and non-sensitive API endpoints for external integration that vary by environment. Which combination of actions should the developer take to store and manage this data securely and cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.; Store the non-sensitive API endpoints in AWS Systems Manager Parameter Store as String parameters.

Answer

Store the database credentials in AWS Secrets Manager with built-in automatic rotation, and store the non-sensitive API endpoints in AWS Systems Manager Parameter Store as String parameters.
Storing database credentials in AWS Secrets Manager takes advantage of native automatic rotation with Amazon RDS, removing the need to manage custom rotation code. Storing non-sensitive configuration parameters like API endpoints in AWS Systems Manager Parameter Store as String parameters is cost-effective because Parameter Store standard parameters are free, whereas Secrets Manager charges per secret.

Step-by-Step Solution

1
Evaluate the security and rotation requirements for the database credentials.
Identify that database credentials are highly sensitive and need to be rotated automatically every 30 days.
AWS Secrets Manager is the optimal service because it has built-in integration with Amazon RDS to rotate credentials automatically via a pre-configured Lambda function.
2
Evaluate the requirement for the non-sensitive API endpoints.
Identify that API endpoints are non-sensitive and vary by environment, meaning they do not require encryption or automatic rotation.
AWS Systems Manager Parameter Store String parameters are free of charge for standard use cases, making it the most cost-effective solution for non-sensitive configurations.
3
Identify the correct combination of options based on AWS best practices.
Select Secrets Manager for the database secret rotation and Parameter Store String parameters for the non-sensitive configuration data.
This combination fulfills all security requirements while optimizing costs.

Key Concept

Differentiating between AWS Secrets Manager and Systems Manager Parameter Store based on security, rotation, and cost requirements.
Estimated Time:2m 0s
Question 17Question →

An enterprise manages its application secrets in a dedicated security AWS account (Account A). A containerized microservice deployed on Amazon ECS Fargate in a production AWS account (Account B) needs access to a third-party payment provider's API key. This API key must be automatically rotated every 30 days using a custom rotation lifecycle, and the microservice must retrieve the plaintext key at runtime via the AWS SDK. Which configuration should the developer implement to meet these requirements securely?

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager in Account A. Attach a resource-based policy to the secret that grants retrieve permissions to the ECS Task Role in Account B. Configure AWS Secrets Manager to automatically rotate the secret every 30 days using a custom AWS Lambda function in Account A.

Answer

Store the API key in AWS Secrets Manager in Account A, allow access to the ECS Task Role in Account B using a resource-based policy, and configure automatic rotation using an AWS Lambda function in Account A.
The correct solution stores the API key in AWS Secrets Manager in Account A because it natively supports resource-based policies for direct cross-account access and provides automatic rotation using AWS Lambda. The permissions must be granted to the ECS Task Role in Account B since the application retrieves the secret at runtime using the AWS SDK.

Step-by-Step Solution

1
Determine the service to use for secret storage and rotation.
AWS Secrets Manager is selected because it natively supports automatic rotation via custom Lambda functions and allows resource-based policies for simple cross-account access.
Systems Manager Parameter Store does not support resource-based policies or built-in automatic rotation.
2
Select the correct IAM role for the Fargate task.
The ECS Task Role is selected.
The application code retrieves the secret at runtime using the AWS SDK, which relies on permissions associated with the Task Role. The Task Execution Role is only used by the container agent during container startup.
3
Configure the cross-account access policy.
A resource-based IAM policy is attached to the secret in Account A, granting 'secretsmanager:GetSecretValue' permissions to the ECS Task Role ARN in Account B.
This configuration allows the Task Role in Account B to directly fetch the secret from Account A without assuming another role.
4
Set up the rotation window and target.
A custom Lambda function in Account A is linked to the secret to handle the API key rotation lifecycle every 30 days.
AWS Secrets Manager handles the scheduling and triggers the Lambda function to coordinate the secret update with the third-party provider.

Key Concept

Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store for secret rotation and cross-account access, while correctly applying ECS Task Roles for runtime application permissions.
Question 18Question →

A developer is deploying a serverless microservice on AWS Lambda that requires access to an Amazon RDS database. The developer needs to store the database host URL (non-sensitive configuration) and the database password (sensitive credential). The database password must be automatically rotated every 30 days. Which combination of actions should the developer take to meet these requirements in the most secure and cost-effective manner? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and enable automatic rotation.; Store the database host URL as a String parameter in AWS Systems Manager Parameter Store.

Answer

The developer should store the database password in AWS Secrets Manager with automatic rotation enabled, and store the database host URL in AWS Systems Manager Parameter Store.
The correct options are storing the database password in AWS Secrets Manager and storing the database host URL in AWS Systems Manager Parameter Store. Storing the password in AWS Secrets Manager ensures security and enables native automatic rotation (especially for RDS). Storing the host URL in Systems Manager Parameter Store is the most cost-effective solution for non-sensitive configuration details because standard parameters in Parameter Store are free, avoiding unnecessary Secrets Manager fees.

Step-by-Step Solution

1
Identify the sensitivity of the data and rotation requirements.
The host URL is non-sensitive, whereas the database password is a sensitive credential requiring automatic rotation.
This allows selecting the most secure and cost-effective service for each type of configuration data.
2
Determine the appropriate service for the sensitive database password.
AWS Secrets Manager is chosen because it supports automatic rotation natively, particularly for Amazon RDS.
Systems Manager Parameter Store does not natively support automatic rotation.
3
Determine the appropriate service for the non-sensitive host URL.
AWS Systems Manager Parameter Store (standard String parameter) is chosen because it is free of charge and ideal for plain text configuration parameters.
Storing non-sensitive data in AWS Secrets Manager would incur unnecessary costs.

Key Concept

Selecting the appropriate secrets management service based on sensitivity, rotation requirements, and cost-efficiency.
Estimated Time:1m 0s
Question 19Question →

A developer is configuring an application running on AWS Elastic Beanstalk that requires access to a database. The database password must be rotated automatically every 30 days. Which solution should the developer implement to meet these security requirements?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and enable the built-in automatic rotation feature.

Answer

Store the database password in AWS Secrets Manager and enable the built-in automatic rotation feature.
AWS Secrets Manager natively supports automatic rotation of database credentials using built-in templates, satisfying the security requirements with minimal effort.

Step-by-Step Solution

1
Analyze the requirement to store database credentials securely with automatic rotation every 30 days.
Automatic rotation of credentials is a primary capability of AWS Secrets Manager.
Choosing a service that natively supports automatic rotation avoids custom code.
2
Evaluate and eliminate options that do not support automatic rotation natively.
AWS Systems Manager Parameter Store and Amazon S3 do not support native automatic rotation.
Eliminating options with high operational overhead narrows down the correct service.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store for automatic secrets rotation
Estimated Time:45s
Question 20Question →

A developer is designing a containerized microservice to be deployed on Amazon Elastic Container Service (Amazon ECS) with the AWS Fargate launch type. The microservice requires secure access to two configurations:
1. A database connection string that is static and changes infrequently.
2. A payment gateway API key that must be automatically rotated every 30 days.
The microservice must retrieve the rotated API key dynamically at runtime without requiring a task restart or redeployment. The developer wants to minimize costs and API call latency.

Which combination of configuration steps should the developer implement to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database connection string as a SecureString parameter in AWS Systems Manager Parameter Store, and reference it in the ECS container definition secrets section using the ECS task execution role for decryption.; Store the payment gateway API key in AWS Secrets Manager, configure automatic rotation using an AWS Lambda function, and retrieve the secret dynamically at runtime using the AWS SDK with permissions granted via the ECS task role.

Answer

Store the database connection string as a SecureString parameter in AWS Systems Manager Parameter Store, referencing it in the ECS container definition secrets section using the ECS task execution role, and store the payment gateway API key in AWS Secrets Manager, configuring automatic rotation using an AWS Lambda function, and retrieving it dynamically at runtime using the AWS SDK with permissions granted via the ECS task role.
For static values like a database connection string, Systems Manager Parameter Store is the most cost-effective solution. Using the ECS container definition's secrets section allows the ECS agent to inject the decrypted parameter as an environment variable at startup, using the Task Execution Role. For values requiring rotation, AWS Secrets Manager is the correct service due to its native support for Lambda-based rotation. To ensure the application dynamically retrieves the rotated key without a task restart, the microservice must query Secrets Manager at runtime using the AWS SDK, leveraging permissions from the ECS Task Role.

Step-by-Step Solution

1
Analyze secret characteristics and choose the storage service.
Determine that SSM Parameter Store is the most cost-effective choice for the static string, while AWS Secrets Manager is required for the API key to utilize built-in automatic rotation.
Standard parameters in Parameter Store have no storage cost, whereas Secrets Manager charges per secret and supports Lambda-based rotation.
2
Determine the injection mechanism for the static secret.
Reference the Parameter Store SecureString in the ECS container definition secrets section.
The ECS agent will retrieve and inject the connection string as an environment variable during container startup using permissions from the task execution role. Since the connection string is static, injecting it at startup is efficient.
3
Determine the retrieval mechanism for the rotating secret.
Use the AWS SDK inside the microservice code to retrieve the API key dynamically from Secrets Manager at runtime.
Environment variables are static once the container is running; querying the API at runtime is necessary to handle rotations dynamically without restarting tasks. The task role provides the application runtime permissions.

Key Concept

Selecting and integrating Secrets Manager vs Parameter Store based on rotation requirements and ECS role configuration.
Page 1 / 3Next