Examkin

Question

Difficulty: MediumData Encryption and Key Management

An e-commerce business needs to secure its application backend. The application requires access to a relational database, and its credentials must be rotated every 30 days. Additionally, the transaction data is stored in an Amazon DynamoDB table and must be encrypted at rest using an AWS Key Management Service (AWS KMS) customer managed key that undergoes automatic annual rotation. Which combination of actions will satisfy these requirements? (Select TWO.)

  1. Store the database credentials in AWS Secrets Manager and configure Secrets Manager to automatically rotate the credentials every 30 days using an AWS Lambda function.Answer
  2. B
    Store the database credentials in AWS Systems Manager Parameter Store as a String parameter, and configure a scheduled Amazon EventBridge rule to update the parameter value every 30 days.
  3. Create a symmetric customer managed key in AWS KMS, enable automatic key rotation, and configure the DynamoDB table to use this customer managed key.Answer
  4. D
    Create a symmetric customer managed key in AWS KMS, enable automatic key rotation, and implement a custom AWS Lambda function to re-encrypt all existing DynamoDB items using the new key version immediately after each rotation.
  5. E
    Store the database credentials in AWS Secrets Manager, and configure the AWS account root user to execute the rotation Lambda function every 30 days.

Answer

To meet the security requirements, the database credentials should be stored in AWS Secrets Manager with automatic rotation enabled every 30 days using an AWS Lambda function. Additionally, a symmetric customer managed key should be created in AWS KMS with automatic key rotation enabled, and the DynamoDB table should be configured to use this key.
The correct solution involves two main parts. First, database credentials must be stored in AWS Secrets Manager, which natively supports automatic rotation every 30 days using an AWS Lambda function. Second, the DynamoDB table must be encrypted using a symmetric customer managed key created in AWS KMS, with automatic key rotation enabled. This ensures that AWS KMS automatically rotates the backing key material every year without affecting the application or requiring manual re-encryption of the data.

Step-by-Step Solution

1
Store the database credentials securely and enable automated rotation.
AWS Secrets Manager is configured with a rotation interval of 30 days, utilizing an AWS Lambda function to update the database credentials without downtime.
AWS Secrets Manager is designed for storing secrets such as database credentials and provides built-in rotation integration with AWS Lambda.
2
Configure encryption at rest for the DynamoDB table using a customer managed key.
A symmetric customer managed key in AWS KMS is created with automatic key rotation enabled, and DynamoDB is configured to encrypt the table data using this key.
Using a customer managed key with automatic rotation enabled meets the requirement of annual key rotation while ensuring DynamoDB encrypts all data at rest securely.

Key Concept

Securing sensitive application credentials using AWS Secrets Manager with automated rotation, and encrypting DynamoDB data at rest using a customer managed key in AWS KMS with automatic rotation.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic