Examkin

Secrets Management and Parameter Store

45 questions

All types45Multiple choice21Multiple select24
Question 21Question →

An application deployed on Amazon EC2 instances must connect to an external database. The developer needs to store the database endpoint URL, which is non-sensitive, and the database credentials, which must be rotated automatically every 30 days. Which combination of actions should the developer take to configure these parameters in a secure and cost-effective manner? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the non-sensitive database endpoint URL as a Parameter Store parameter.; Store the database credentials in AWS Secrets Manager with automatic rotation enabled.

Answer

Store the non-sensitive database endpoint URL as a Parameter Store parameter, and store the database credentials in AWS Secrets Manager with automatic rotation enabled.
Storing the non-sensitive database endpoint in Systems Manager Parameter Store provides a low-cost, fully-managed configuration store. Storing the sensitive database credentials in AWS Secrets Manager provides native automated credentials rotation, which meets security requirements with minimal operational overhead.

Step-by-Step Solution

1
Identify parameter sensitivity and rotation requirements.
The database endpoint URL is non-sensitive and does not require rotation. The database credentials are sensitive and require regular rotation.
Correct classification helps in choosing the most cost-effective and secure service.
2
Select the appropriate AWS service for each parameter class.
Use Systems Manager Parameter Store for the endpoint URL, and use AWS Secrets Manager for the database credentials.
Parameter Store offers cost-effective storage for configuration parameters, whereas Secrets Manager provides out-of-the-box automatic rotation for sensitive credentials.

Key Concept

Selecting between Systems Manager Parameter Store and AWS Secrets Manager based on credential sensitivity and automatic rotation requirements.
Question 22Question →

A developer is configuring a web application running on Amazon EC2 instances in an Auto Scaling group. The application must retrieve a database password to connect to an Amazon Aurora PostgreSQL DB cluster. The database password must be rotated every 30 days. Both the EC2 instances and the database cluster are deployed in private subnets within a VPC that has no internet connectivity. Which combination of steps should the developer take to meet these requirements securely with the minimum operational overhead?

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager. Enable automatic rotation on the secret using the single-user rotation template for Amazon RDS, and configure the Lambda rotation function to run in the private subnets of the VPC. Create an interface VPC endpoint for Secrets Manager, and assign an IAM role to the EC2 instances that grants access to the secret.

Answer

Store the database password in AWS Secrets Manager. Enable automatic rotation on the secret using the single-user rotation template for Amazon RDS, and configure the Lambda rotation function to run in the private subnets of the VPC. Create an interface VPC endpoint for Secrets Manager, and assign an IAM role to the EC2 instances that grants access to the secret.
The correct solution uses AWS Secrets Manager, which natively supports automated rotation of RDS database credentials using pre-built Lambda templates. Since the database and EC2 instances reside in a private VPC without internet access, deploying the Lambda rotation function inside the VPC allows it to reach the database. Creating an interface VPC endpoint for Secrets Manager allows the EC2 instances and the Lambda rotation function to securely interact with Secrets Manager privately. Access is granted to the EC2 instances via an IAM instance profile, ensuring no credentials are hardcoded.

Step-by-Step Solution

1
Store the secret in AWS Secrets Manager.
The database password is encrypted and stored securely.
AWS Secrets Manager is designed for storing secrets (like passwords and API keys) and supports native automatic rotation.
2
Enable automatic rotation using the standard RDS template and deploy the rotation Lambda function within the VPC private subnets.
Secrets Manager automatically manages password updates in both the database and the secret storage every 30 days.
Since the database has no public internet access, the Lambda function must run inside the VPC to connect to the database cluster and update the password.
3
Create an interface VPC endpoint (AWS PrivateLink) for AWS Secrets Manager in the VPC.
The EC2 instances and the Lambda rotation function can securely connect to Secrets Manager without internet access.
An interface VPC endpoint allows secure, private traffic routing to AWS services within a isolated VPC.
4
Attach an IAM role containing Secrets Manager read access to the EC2 instance profile.
The application retrieves the credential dynamically at runtime.
This avoids hardcoding credentials and uses temporary security credentials instead.

Key Concept

AWS Secrets Manager vs. Systems Manager Parameter Store and Private VPC Networking Integration
Question 23Question →

A developer is implementing a microservice that integrates with an external service provider. The integration requires a sensitive API key that needs to be rotated automatically every 90 days. Which AWS service should the developer use to store this API key and handle its automatic rotation?

Show answer & explanation

Answer: AWS Secrets Manager

Answer

AWS Secrets Manager is the correct service to use because it is specifically designed to store sensitive API keys and supports automated rotation using AWS Lambda.
AWS Secrets Manager is designed to store secrets and credentials securely. It has native support for automatic rotation of secrets using built-in templates or custom AWS Lambda functions.

Step-by-Step Solution

1
Identify the primary requirement.
The requirement is to store a sensitive API key and automatically rotate it every 90 days.
This helps determine which AWS service supports both secure storage and automatic lifecycle management.
2
Compare candidate AWS services.
AWS Secrets Manager provides built-in integration with Lambda for automatic secret rotation. Systems Manager Parameter Store does not support automated rotation out of the box. AWS KMS manages cryptographic keys, not the secret payloads themselves.
Choosing the service with native rotation capability minimizes custom development and operational overhead.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on security and rotation requirements.
Estimated Time:45s
Question 24Question →

A serverless application running on AWS Lambda needs to retrieve configuration data. This includes a database hostname, which is a non-sensitive configuration parameter, and a database password, which is a sensitive credential that must be rotated automatically every month. Which two options describe the most secure and cost-effective locations to store these values? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Secrets Manager to store the database password; Systems Manager Parameter Store to store the database hostname

Answer

Secrets Manager should be used to store the database password because it supports automatic rotation, while Systems Manager Parameter Store should be used to store the database hostname to optimize costs for non-sensitive configuration data.
Storing the database password in Secrets Manager satisfies the requirement for automatic rotation. Storing the database hostname in Systems Manager Parameter Store provides a cost-effective solution for non-sensitive configuration data that does not need rotation.

Step-by-Step Solution

1
Analyze the requirements for the database password.
The password is a sensitive credential requiring automatic rotation.
Secrets Manager is selected because it manages secrets and supports automatic rotation natively.
2
Analyze the requirements for the database hostname.
The hostname is a non-sensitive configuration parameter that does not require rotation.
Systems Manager Parameter Store is selected because it is cost-effective and suited for standard configuration parameters.

Key Concept

Distinguishing between Secrets Manager and Systems Manager Parameter Store based on security, rotation requirements, and cost-efficiency.
Estimated Time:1m 0s
Question 25Question →

To comply with security audits, the database password for an Amazon Aurora MySQL database must be stored securely and rotated automatically on a recurring schedule. Which AWS service should a developer use to manage this password and its automatic rotation?

Show answer & explanation

Answer: AWS Secrets Manager

Answer

AWS Secrets Manager
AWS Secrets Manager is the correct choice because it is specifically designed for managing, retrieving, and rotating database credentials, API keys, and other secrets. It has built-in integration with Amazon RDS and Amazon Aurora to rotate database credentials automatically without requiring application redeployment.

Step-by-Step Solution

1
Identify the primary requirement
The requirement is to securely store a database password and rotate it automatically on a schedule.
This determines which AWS service has the native capabilities to handle automated lifecycle management of secrets.
2
Evaluate the capabilities of AWS Secrets Manager versus AWS Systems Manager Parameter Store
AWS Secrets Manager offers built-in integration with RDS and Aurora databases to automatically rotate credentials using AWS Lambda, whereas Parameter Store does not support automatic rotation.
Choosing the service that supports out-of-the-box rotation minimizes custom development and operational overhead.

Key Concept

AWS Secrets Manager provides native support for the automatic rotation of database credentials, whereas AWS Systems Manager Parameter Store does not.
Estimated Time:45s
Question 26Question →

A developer is configuring a containerized microservice deployed on AWS App Runner that needs to access a secure legacy database running on-premises and a third-party logistics API. The database credentials must be rotated automatically every 30 days using a custom rotation function that interacts with the on-premises database via an AWS Direct Connect connection. The third-party logistics API key is static, does not require automated rotation, and needs to be shared across multiple development environments cost-effectively. Which combination of steps should the developer take to manage these credentials in compliance with security best practices? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the on-premises database credentials in AWS Secrets Manager, and configure a custom rotation Lambda function associated with a VPC to rotate the password every 30 days.; Store the third-party logistics API key in AWS Systems Manager Parameter Store as a SecureString parameter to leverage its free tier and cross-environment accessibility.

Answer

The developer should store the on-premises database credentials in AWS Secrets Manager and configure a custom rotation Lambda function associated with a VPC to rotate the password, while storing the third-party logistics API key in AWS Systems Manager Parameter Store as a SecureString parameter.
The database credentials require automated rotation and access to an on-premises network over Direct Connect, which is best handled by AWS Secrets Manager using a custom VPC-configured Lambda function. For the static API key that does not require automatic rotation, AWS Systems Manager Parameter Store SecureString is the most cost-effective option since standard parameters do not incur a monthly fee.

Step-by-Step Solution

1
Analyze rotation and network requirements for the database credentials.
Since the legacy database is on-premises and requires automatic 30-day rotation, AWS Secrets Manager is selected. A custom Lambda function is required because native templates do not support on-premises targets. The Lambda function must be associated with a VPC to route traffic over AWS Direct Connect.
Secrets Manager provides native scheduling for rotation, and custom Lambda functions can be deployed inside a VPC to access private or on-premises networks.
2
Analyze rotation and cost requirements for the static API key.
Since the third-party logistics API key is static, does not require automated rotation, and needs to be shared across environments cost-effectively, AWS Systems Manager Parameter Store is selected as a SecureString parameter.
Parameter Store standard parameters are free, making it the most cost-effective choice for secrets that do not require the automatic rotation feature of Secrets Manager.
3
Ensure secure reference and deployment architectures.
Avoid embedding any credentials in the Dockerfile or application source code, and retrieve them dynamically at runtime from their respective parameter store and secrets manager locations.
This prevents credential leakage via image registries or source repositories.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on automatic rotation requirements, network path constraints, and cost optimization.
Estimated Time:2m 30s
Question 27Question →

A developer is deploying a Python application to AWS Elastic Beanstalk. The application needs to retrieve two values: a connection string password for a self-hosted PostgreSQL database running on an Amazon EC2 instance (which must be rotated every 45 days), and a payment gateway API endpoint URL (which is non-sensitive and static). To meet these requirements with the lowest cost and operational effort, which two configuration steps should the developer perform? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure an AWS Lambda function to rotate the database credential on a 45-day schedule.; Store the payment gateway API endpoint URL in AWS Systems Manager Parameter Store as a String parameter.

Answer

Store the database password in AWS Secrets Manager with a Lambda rotation function, and store the non-sensitive payment gateway URL in AWS Systems Manager Parameter Store.
AWS Secrets Manager is designed for storing sensitive data like database passwords and supports automatic rotation using AWS Lambda. On the other hand, Systems Manager Parameter Store is a cost-effective service for storing non-sensitive configuration data such as API endpoint URLs, which do not change frequently and do not require rotation.

Step-by-Step Solution

1
Analyze the security and rotation requirements for the database password.
The password is a sensitive credential and must be rotated automatically every 45 days. AWS Secrets Manager is the appropriate service because it supports automatic rotation schedules and integration with Lambda for rotating self-hosted databases.
Parameter Store does not natively support automatic rotation schedules.
2
Analyze the storage requirements for the payment gateway API endpoint URL.
The URL is non-sensitive and static. AWS Systems Manager Parameter Store is the most cost-effective and appropriate service for storing simple, non-sensitive configuration data.
Secrets Manager is more expensive and unnecessary for non-sensitive data.
3
Combine the decisions into the correct configuration steps.
Store the database password in Secrets Manager with Lambda rotation, and store the API URL in Parameter Store.
This combination ensures security compliance for the password and cost-efficiency for the configuration data.

Key Concept

Differentiating between AWS Secrets Manager and Systems Manager Parameter Store based on secrets rotation requirements and cost-efficiency.
Question 28Question →

A developer is configuring a containerized application running on Amazon ECS that needs to access two settings: a public API endpoint URL (non-sensitive configuration) and a database password for an Amazon RDS database. The database password must be rotated automatically every 30 days. To ensure the design is both secure and cost-effective, which configuration should the developer implement?

Show answer & explanation

Answer: Store the public API endpoint URL as a String parameter in AWS Systems Manager Parameter Store. Store the database password in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.

Answer

Store the public API endpoint URL as a String parameter in AWS Systems Manager Parameter Store. Store the database password in AWS Secrets Manager and configure automatic rotation using the built-in RDS rotation template.
The correct configuration uses AWS Systems Manager Parameter Store for non-sensitive parameters like the API endpoint URL, which minimizes costs. It uses AWS Secrets Manager for the database password because Secrets Manager supports native integration with Amazon RDS to automatically rotate the password, fulfilling the security requirement without requiring custom rotation logic.

Step-by-Step Solution

1
Analyze the sensitivity and lifecycle requirements of both configuration settings.
The API endpoint URL is non-sensitive, static configuration, while the database password is highly sensitive and requires automated rotation every 30 days.
This determines which AWS service is best suited for each parameter to optimize for cost and operational efficiency.
2
Select the appropriate storage service for the non-sensitive configuration.
AWS Systems Manager Parameter Store (String parameter) is selected.
Parameter Store standard parameters are free and ideal for non-sensitive configurations, making this the most cost-effective choice.
3
Select the appropriate storage service and rotation mechanism for the database password.
AWS Secrets Manager is selected, configured with the built-in RDS automatic rotation.
Secrets Manager provides native, out-of-the-box integration with Amazon RDS for automated password rotation, meeting the security and rotation requirements with minimal operational overhead.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on sensitivity, automatic rotation requirements, and cost-effectiveness.
Question 29Question →

A developer is designing a serverless data ingestion application on AWS Lambda. The application requires access to a third-party service API key that must be rotated automatically every 30 days, as well as a non-sensitive database port number that does not change. To minimize cost and operational overhead, which two actions should the developer take to store and manage these parameters? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager and configure a Lambda function to handle the rotation.; Store the database port number in AWS Systems Manager Parameter Store as a Standard parameter.

Answer

Store the API key in AWS Secrets Manager with a Lambda rotation function, and store the database port number in AWS Systems Manager Parameter Store as a Standard parameter.
The correct options are to store the API key in AWS Secrets Manager with a Lambda rotation function, and to store the database port in AWS Systems Manager Parameter Store as a Standard parameter. AWS Secrets Manager is appropriate because it supports automatic rotation out-of-the-box. Systems Manager Parameter Store Standard parameters are the correct choice for non-sensitive data because they do not incur a monthly configuration cost.

Step-by-Step Solution

1
Analyze the requirements for the API key
The API key is highly sensitive and requires automatic rotation every 30 days.
AWS Secrets Manager is designed for storing secrets and provides native integration with AWS Lambda to rotate secrets automatically.
2
Analyze the requirements for the database port number
The database port is non-sensitive and static.
AWS Systems Manager Parameter Store is ideal for storing non-sensitive configuration parameters. Standard parameters are free of charge, helping minimize costs.
3
Select the optimal combination of services to minimize cost and overhead
Use Secrets Manager for the API key to handle automatic rotation, and Parameter Store for the port number to avoid Secrets Manager costs.
This separation aligns with the AWS well-architected best practices of cost optimization and security.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on cost, sensitivity, and automatic rotation requirements.
Question 30Question →

A developer is implementing a microservice in AWS Account A that needs to securely access a database credential managed in a centralized security AWS Account B. The microservice must access the credential directly without assuming an IAM role in Account B. Which approach should the developer use to meet these requirements?

Show answer & explanation

Answer: Store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret that allows the IAM execution role of the microservice in Account A to retrieve it, and encrypt the secret using an AWS KMS customer managed key that grants decryption permissions to Account A.

Answer

Store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret that allows the IAM execution role of the microservice in Account A to retrieve it, and encrypt the secret using an AWS KMS customer managed key that grants decryption permissions to Account A.
The correct approach is to store the credential in AWS Secrets Manager in Account B, attach a resource-based policy to the secret to allow Account A's role to retrieve it, and use a customer managed KMS key that grants cross-account decryption permissions. AWS Secrets Manager supports resource-based policies, enabling direct access from another account without assuming a role. Additionally, default AWS managed KMS keys cannot be shared across accounts, necessitating a customer managed key.

Step-by-Step Solution

1
Determine the correct service that supports cross-account sharing via resource-based policies.
AWS Secrets Manager is chosen because Systems Manager Parameter Store does not support resource-based policies for cross-account access.
The requirement is to access the credential directly without assuming an IAM role, which requires resource-based authorization on the secret itself.
2
Establish encryption requirements for cross-account access using AWS KMS.
An AWS KMS customer managed key must be used instead of the default AWS managed key (aws/secretsmanager).
Default AWS managed KMS keys cannot be shared across accounts. A customer managed key is required so its key policy can be modified to grant decryption access to the IAM role in Account A.
3
Configure the resource-based policy on the secret.
Attach a resource policy to the Secrets Manager secret allowing the principal from Account A to perform the GetSecretValue action.
This allows the microservice's execution role in Account A to retrieve the secret payload directly.

Key Concept

Cross-account access capabilities and encryption configurations in AWS Secrets Manager versus Systems Manager Parameter Store.
Question 31Question →

A developer is deploying an application to a fleet of Amazon EC2 instances in an Auto Scaling group. The application needs to retrieve two configuration settings: a database password for an Amazon Aurora PostgreSQL database that must be rotated automatically every 30 days, and a non-sensitive external API endpoint URL. The developer wants to minimize operational overhead and cost. Which combination of actions should the developer take to store these configurations? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.; Store the external API endpoint URL as a Standard parameter in AWS Systems Manager Parameter Store.

Answer

Store the database password in AWS Secrets Manager with Lambda-based automatic rotation, and store the non-sensitive external API endpoint URL as a Standard parameter in AWS Systems Manager Parameter Store.
Storing the database password in AWS Secrets Manager allows the developer to easily schedule and automate rotation using AWS Lambda. Storing the non-sensitive API endpoint URL as a Standard parameter in Systems Manager Parameter Store is the most cost-effective approach since Parameter Store's Standard tier does not charge for storage or API interactions under normal limits, whereas Secrets Manager charges per secret.

Step-by-Step Solution

1
Determine the storage for the sensitive database credentials that require rotation.
AWS Secrets Manager is selected because it natively integrates with Amazon Aurora and supports automated rotation through AWS Lambda.
Systems Manager Parameter Store lacks native rotation scheduling.
2
Determine the storage for the non-sensitive configuration endpoint URL.
AWS Systems Manager Parameter Store (Standard tier) is selected.
Standard parameters in Parameter Store have no storage cost, making it the most cost-effective solution for non-sensitive data.

Key Concept

Distinguishing between AWS Secrets Manager and Systems Manager Parameter Store based on rotation requirements and cost-efficiency.
Estimated Time:1m 30s
Question 32Question →

A developer is deploying a microservice to Amazon Elastic Container Service (Amazon ECS) on AWS Fargate. The microservice needs to connect to an Amazon Aurora MySQL database. The database credentials must be rotated automatically every 30 days to comply with organizational security policies. The developer needs to implement a solution that retrieves these credentials securely without hardcoding them or causing application downtime during rotation.

Which two actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and enable automatic rotation using the built-in rotation function for Amazon RDS.; Associate an IAM policy that allows the secretsmanager:GetSecretValue action to the ECS Task Role, and retrieve the credentials dynamically using the AWS SDK in the application code.

Answer

Store the database credentials in AWS Secrets Manager with automatic RDS rotation enabled, and retrieve the credentials dynamically using the AWS SDK in the application code with permissions granted by the ECS Task Role.
To securely manage and rotate database credentials without causing downtime, the credentials should be stored in AWS Secrets Manager. Secrets Manager offers native integration with Amazon RDS to rotate secrets automatically. To access the secret from the container, the application code must query Secrets Manager using the AWS SDK, which requires assigning permissions to the ECS Task Role. Since rotation happens every 30 days, retrieving the credentials dynamically ensures that the application always uses the most current password without requiring task restarts.

Step-by-Step Solution

1
Choose the correct secrets storage service.
AWS Secrets Manager is selected because the database credentials require automatic rotation and direct RDS integration, which are features native to Secrets Manager and not natively supported by Systems Manager Parameter Store.
This satisfies the security requirement for automatic 30-day rotation without complex custom Lambda logic.
2
Configure the application to retrieve credentials dynamically.
The application code is configured to use the AWS SDK to retrieve the database credentials from Secrets Manager at runtime rather than injecting them via environment variables at startup.
This prevents application downtime and stale credentials when rotation occurs.
3
Assign the appropriate IAM role and policy to the ECS container.
An IAM policy granting the secretsmanager:GetSecretValue permission is attached to the ECS Task Role.
The ECS Task Role is the identity assumed by the application code running inside the container to make AWS SDK calls.

Key Concept

AWS Secrets Manager vs Systems Manager Parameter Store, and ECS Task Roles vs Task Execution Roles.
Question 33Question →

A developer is deploying a containerized application to Amazon Elastic Kubernetes Service (Amazon EKS). The application requires access to a database password for an Amazon RDS DB instance and an API key for a third-party service. The database password must be rotated every 30 days. The third-party API key changes infrequently, and the developer wants to access it with minimum latency and cost. Which combination of steps should the developer take to retrieve these configurations securely and cost-effectively? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database password in AWS Secrets Manager and configure automatic rotation using an AWS Lambda function.; Store the third-party API key as a SecureString parameter in AWS Systems Manager Parameter Store and retrieve it via the application.

Answer

Store the database password in AWS Secrets Manager with Lambda rotation, and store the third-party API key as a SecureString parameter in AWS Systems Manager Parameter Store.
The correct combination involves storing the database password in AWS Secrets Manager because it natively supports automatic rotation via Lambda, and storing the third-party API key in AWS Systems Manager Parameter Store as a SecureString parameter because standard parameters are free and ideal for infrequently changing secrets.

Step-by-Step Solution

1
Analyze requirements for the database password.
The database password requires automatic rotation every 30 days. AWS Secrets Manager natively supports automatic rotation (using an AWS Lambda function) and is the correct choice.
Parameter Store does not support automated secret rotation natively.
2
Analyze requirements for the third-party API key.
The API key changes infrequently, does not require automated rotation, and must be accessed with minimal cost. AWS Systems Manager Parameter Store (specifically standard SecureString parameters) is free of charge and provides low latency.
Using Secrets Manager for this key would incur unnecessary monthly fees.

Key Concept

Selecting between AWS Secrets Manager and Systems Manager Parameter Store based on rotation, cost, and lifecycle requirements.
Question 34Question →

A developer is implementing a serverless payment microservice using AWS Lambda. The microservice needs to securely access a third-party API key that must be rotated every 90 days. Which solution should the developer implement to manage and rotate this API key with the lowest operational overhead?

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager. Configure automatic rotation for the secret, and associate a custom AWS Lambda function to execute the rotation steps with the payment provider.

Answer

Store the API key in AWS Secrets Manager, configure automatic rotation, and associate a custom AWS Lambda function to handle the rotation lifecycle events with the third-party payment provider.
AWS Secrets Manager is designed to store, manage, and rotate secrets. For third-party APIs that do not have built-in rotation integration in AWS, Secrets Manager allows you to configure automatic rotation by invoking a custom AWS Lambda function. This custom function implements the rotation logic (e.g., creating a new key with the provider and updating the secret value) automatically on the set schedule, minimizing operational overhead.

Step-by-Step Solution

1
Identify the requirement for secure credential storage with automatic rotation for a third-party API key.
Determine that AWS Secrets Manager is the primary AWS service designed for secrets management and automated rotation of credentials.
AWS Systems Manager Parameter Store does not support native rotation, and embedding secrets in code or deployment packages violates security best practices.
2
Configure the rotation schedule in AWS Secrets Manager.
Enable automatic rotation for the secret and specify a rotation schedule of 90 days.
Secrets Manager requires an orchestration schedule to run the rotation process periodically.
3
Develop and associate a custom AWS Lambda function with the Secrets Manager secret.
The custom Lambda function handles the rotation steps: creating a new version of the secret, testing it against the third-party provider, and finalizing the rotation.
Standard automatic rotation templates exist for AWS databases, but custom APIs require a custom rotation Lambda function to communicate with the external service.

Key Concept

Secrets Management and Parameter Store
Question 35Question →

An organization requires a developer to build a secure configuration strategy for an application running on AWS Lambda. The application must connect to an Amazon RDS PostgreSQL database, which requires credentials to be rotated every 30 days. The application also needs to access non-sensitive service configuration parameters that change frequently. To minimize costs and management overhead, which of the following actions should the developer take? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation.; Store the non-sensitive service configuration parameters as standard parameters in AWS Systems Manager Parameter Store.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation configured, and store the non-sensitive service configuration parameters as standard parameters in AWS Systems Manager Parameter Store.
Storing database credentials in AWS Secrets Manager with automatic rotation configured satisfies the security requirement natively. Storing non-sensitive configuration parameters in AWS Systems Manager Parameter Store standard parameters satisfies the cost-effectiveness requirement, as standard parameters in Parameter Store do not incur any additional charges.

Step-by-Step Solution

1
Identify the storage requirements for the database credentials, which include secure storage and automatic rotation every 30 days.
Determine that AWS Secrets Manager is the appropriate service because it natively supports secret rotation for databases.
Systems Manager Parameter Store does not offer built-in automatic rotation.
2
Identify the storage requirements for the non-sensitive configuration parameters, which need to be updated frequently and stored cost-effectively.
Determine that Systems Manager Parameter Store standard parameters are the best choice since they are free.
Storing non-sensitive values in Secrets Manager incurs unnecessary costs.
3
Ensure secure SDK initialization inside the Lambda function without hardcoding credentials.
Determine that IAM roles should be used for authentication instead of passing hardcoded access keys in the code.
Hardcoding credentials in the SDK initialization violates security best practices.

Key Concept

Selecting the appropriate AWS service (Secrets Manager vs. Parameter Store) based on rotation requirements and cost-effectiveness, while adhering to secure credential management practices.
Question 36Question →

A developer is implementing a custom Lambda authorizer for Amazon API Gateway. The authorizer must validate incoming JSON Web Tokens (JWT) using a secret client key that is updated manually every six months. The API receives millions of requests daily, and the developer wants to minimize AWS service costs associated with secret retrieval while maintaining security. Which strategy should the developer use?

Show answer & explanation

Answer: Store the secret client key as a SecureString parameter in AWS Systems Manager Parameter Store. Retrieve the parameter outside the Lambda handler function to cache it, and enable caching on the API Gateway authorizer.

Answer

Store the secret client key as a SecureString parameter in AWS Systems Manager Parameter Store, retrieve it outside the Lambda handler for caching, and enable authorizer caching in API Gateway.
Storing the key as a SecureString in Systems Manager Parameter Store satisfies the security requirement by encrypting the secret at rest with AWS KMS. Since the key is rotated manually every six months, the automatic rotation features of Secrets Manager are not needed. Choosing Parameter Store is highly cost-effective because standard parameters do not incur API request fees. Furthermore, caching the secret outside the Lambda handler ensures it is reused across warm container invocations, and enabling authorizer caching in API Gateway prevents invoking the Lambda function for every incoming client request.

Step-by-Step Solution

1
Evaluate the encryption and rotation requirements for the secret client key.
The key must be stored securely with encryption, but it is rotated manually every six months rather than requiring automatic rotation.
This determines whether the advanced automatic rotation features of AWS Secrets Manager are required.
2
Evaluate the scale and cost implications of the AWS services under a high-volume request load.
Secrets Manager charges per API call, which is expensive at millions of requests per day. Systems Manager Parameter Store standard parameters provide SecureString encryption using AWS KMS keys without per-request charges.
This identifies Parameter Store as the most cost-effective option for manually rotated secrets at scale.
3
Optimize key retrieval performance and rate limiting.
Retrieve the Parameter Store value outside the Lambda handler to cache the value across execution contexts, and enable caching on the API Gateway authorizer.
This reduces latency, prevents API rate-limiting issues on Parameter Store, and minimizes Lambda executions.

Key Concept

Parameter Store vs Secrets Manager cost and features trade-offs
Estimated Time:1m 30s
Question 37Question →

An application deployed on AWS Batch needs to retrieve two types of configuration values: database credentials that must be automatically rotated every 30 days, and non-sensitive application settings (such as logging levels and API endpoints) that do not require rotation. Which combination of actions should the developer take to retrieve these values securely, cost-effectively, and with minimal operational overhead? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in rotation templates.; Store the logging level and API endpoints in AWS Systems Manager Parameter Store.

Answer

Store the database credentials in AWS Secrets Manager with automatic rotation configured, and store the non-sensitive parameters (logging level and API endpoints) in AWS Systems Manager Parameter Store.
The correct strategy combines AWS Secrets Manager and AWS Systems Manager Parameter Store. Storing database credentials in AWS Secrets Manager allows utilizing its native automatic rotation feature to change passwords every 30 days without custom scripts. Storing non-sensitive configuration data, such as logging levels and API endpoints, in Parameter Store is highly cost-effective and avoids the monthly per-secret cost of Secrets Manager.

Step-by-Step Solution

1
Analyze rotation and security requirements.
Database credentials require secure storage and automatic rotation, while logging levels and API endpoints are non-sensitive and do not require rotation.
This determines which AWS service provides the best combination of security, features, and cost efficiency.
2
Select the service for credentials.
AWS Secrets Manager is chosen for the database credentials.
Secrets Manager has built-in integration to rotate credentials automatically and securely.
3
Select the service for non-sensitive configurations.
AWS Systems Manager Parameter Store is chosen for logging levels and API endpoints.
Parameter Store is more cost-effective for configuration data that does not require rotation or advanced secrets management features.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on security, rotation requirements, and cost optimization.
Estimated Time:1m 30s
Question 38Question →

A company is deploying a microservices-based application on Amazon Elastic Container Service (Amazon ECS). The application requires access to two types of data: database credentials for an Amazon RDS database that must be rotated automatically every 14 days, and a non-sensitive configuration setting indicating the application's logging level. The developer wants to implement a secure solution that minimizes both management overhead and overall cost. Which of the following actions should the developer take to meet these requirements? (Select TWO.)

Select all that apply

Show answer & explanation

Answer: Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in integration for Amazon RDS.; Store the logging level configuration in Systems Manager Parameter Store as a Standard parameter to optimize costs.

Answer

Store the database credentials in AWS Secrets Manager and configure automatic rotation using the built-in integration for Amazon RDS, and store the logging level configuration in Systems Manager Parameter Store as a Standard parameter to optimize costs.
The correct options involve storing the database credentials in AWS Secrets Manager and the logging level in Systems Manager Parameter Store. AWS Secrets Manager natively integrates with Amazon RDS to provide automatic credential rotation without manual overhead, which satisfies the 14-day rotation requirement. Systems Manager Parameter Store Standard parameters are free of charge, making them the most cost-effective choice for storing non-sensitive configuration settings like application logging levels.

Step-by-Step Solution

1
Evaluate the database credential requirements for automatic rotation.
AWS Secrets Manager is selected because it has built-in integration with Amazon RDS to rotate credentials automatically without manual coding.
This satisfies the security requirement for rotating credentials every 14 days with minimal administrative overhead.
2
Evaluate the configuration setting requirement for cost-effectiveness.
Systems Manager Parameter Store is selected because Standard parameters are free of charge and suitable for non-sensitive data.
This minimizes overall costs by avoiding the hosting fees associated with AWS Secrets Manager for non-sensitive configuration data.

Key Concept

Choosing between AWS Secrets Manager and Systems Manager Parameter Store based on rotation capabilities and cost optimization.
Estimated Time:1m 30s
Question 39Question →

A developer is building a serverless orchestration workflow using AWS Step Functions. One of the workflow's task states invokes an AWS Lambda function that integrates with a third-party merchant API. The merchant API requires a secure API key for authentication. The company's security policy requires that this API key be rotated every 30 days. Which solution meets these requirements with the least operational overhead?

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager. Configure automatic rotation for the secret on a 30-day schedule using a rotation Lambda function, and configure the integration Lambda function to retrieve the secret at runtime.

Answer

Store the API key in AWS Secrets Manager. Configure automatic rotation for the secret on a 30-day schedule using a rotation Lambda function, and configure the integration Lambda function to retrieve the secret at runtime.
The correct option is to use AWS Secrets Manager with its built-in automatic rotation feature, configured with a rotation Lambda function on a 30-day schedule. AWS Secrets Manager is specifically designed for managing, rotating, and retrieving secrets securely at runtime, which satisfies the requirements with the lowest operational overhead.

Step-by-Step Solution

1
Evaluate the need for encryption and automatic rotation of credentials.
Identify that AWS Secrets Manager is the standard service designed to handle secrets requiring automatic rotation natively.
Systems Manager Parameter Store does not offer native automatic rotation out of the box.
2
Compare Secrets Manager and Systems Manager Parameter Store for custom third-party secrets.
Choose Secrets Manager because it supports automatic rotation via custom Lambda functions, minimizing custom orchestration code.
Implementing rotation in Parameter Store requires custom EventBridge rules and manual orchestration, increasing operational overhead.
3
Ensure the integration Lambda function retrieves the secret at runtime.
Avoid hardcoding or environment variables that complicate rotation and compromise security.
Retrieving the secret at runtime ensures that rotation does not break the integration Lambda function.

Key Concept

Secrets Manager vs Systems Manager Parameter Store Rotation Capabilities
Estimated Time:1m 30s
Question 40Question →

A developer is building a backend application on AWS Lambda that integrates with a third-party payment gateway. The integration requires an API key that is rotated automatically every 30 days. The developer needs to store the API key securely, automate its rotation, and retrieve it in the Lambda function with minimal latency. Which storage and management approach should the developer use to meet these requirements with the least operational effort?

Show answer & explanation

Answer: Store the API key in AWS Secrets Manager. Configure automated rotation in AWS Secrets Manager by writing a custom AWS Lambda rotation function, and retrieve the key in the backend Lambda function using the AWS SDK with local caching.

Answer

Store the API key in AWS Secrets Manager, configure automated rotation using a custom Lambda function, and retrieve the key in the backend Lambda function using the AWS SDK with local caching.
Storing the API key in AWS Secrets Manager and configuring a custom Lambda rotation function allows AWS to natively manage the rotation schedule and execution. The application Lambda function retrieves the key at runtime using the AWS SDK, and caching it locally ensures subsequent invocations do not call Secrets Manager unnecessarily, minimizing latency and API costs.

Step-by-Step Solution

1
Create a secret in AWS Secrets Manager to store the third-party payment gateway API key.
The API key is securely encrypted and stored.
AWS Secrets Manager is optimized for securing credentials and sensitive values.
2
Configure AWS Secrets Manager rotation settings by linking a custom AWS Lambda rotation function and setting the schedule to 30 days.
Secrets Manager automatically invokes the Lambda function on schedule to update the secret value.
This automates the rotation lifecycle with native orchestrations instead of custom cron schedulers.
3
Update the application Lambda function to retrieve the API key using the AWS SDK and cache the value in memory.
The key is fetched at startup or initialization and reused across invocations, lowering latency and reducing cost.
Local caching minimizes the number of API calls to AWS Secrets Manager.

Key Concept

Automating secret rotation using AWS Secrets Manager vs manual orchestration or insecure alternatives.
PreviousPage 2 / 3Next
Secrets Management and Parameter Store Practice Questions — AWS Certified Developer - Associate — Page 2 | Examkin