Examkin

Question

Difficulty: MediumData Encryption and Key Management

A company is deploying a three-tier web application on Amazon EC2 instances. The application needs to retrieve a database password to connect to an Amazon RDS DB instance, as well as an external API key that does not support automated rotation. Security requirements dictate that all credentials must be encrypted at rest, and the database password must be rotated every 30 days.

Which solution meets these requirements with the least administrative effort?

  1. A
    Store the database password in AWS Secrets Manager. Enable automatic rotation on the associated KMS customer managed key, which will automatically rotate the database credentials and re-encrypt the database table contents every 30 days.
  2. Store the database password in AWS Secrets Manager and enable automatic rotation every 30 days using the built-in integration for Amazon RDS. Store the external API key as a SecureString parameter in AWS Systems Manager Parameter Store.Answer
  3. C
    Store both the database password and the external API key as standard String parameters in AWS Systems Manager Parameter Store to simplify credential retrieval and reduce costs.
  4. D
    Store the database password in an Amazon S3 bucket with default encryption using an AWS KMS key. Enable automatic KMS key rotation on the customer managed key to automatically re-encrypt the existing credentials file with a new key version every 30 days.

Answer

Store the database password in AWS Secrets Manager with automatic RDS rotation, and store the API key as a SecureString parameter in Systems Manager Parameter Store.
The correct solution stores the database password in AWS Secrets Manager because it has built-in integration to automatically rotate RDS credentials. The external API key is stored as a SecureString parameter in Systems Manager Parameter Store, which encrypts the value at rest using AWS KMS, meeting all security requirements with the least operational effort.

Step-by-Step Solution

1
Analyze the requirements for the database credentials.
The database password needs to be encrypted at rest and rotated every 30 days. AWS Secrets Manager offers native, automated integration to rotate database credentials for Amazon RDS instances.
Secrets Manager can automatically manage the lifecycle of database secrets without writing custom rotation logic, reducing operational overhead.
2
Analyze the requirements for the external API key.
The API key must be encrypted at rest but does not require rotation. AWS Systems Manager Parameter Store using the SecureString parameter type can encrypt the parameter using AWS KMS.
SecureString parameters provide a cost-effective, secure storage mechanism for secrets that do not require lifecycle management or automatic rotation.
3
Evaluate KMS key rotation behavior versus credential rotation.
Confirm that KMS key rotation only affects the backing key material used to generate new data keys and does not rotate the actual database password or update database user accounts.
Understanding key rotation mechanics prevents the misconception that key rotation solves application-level credential rotation.

Key Concept

Distinction between AWS Secrets Manager and Systems Manager Parameter Store, and the operational behavior of KMS key rotation vs credential rotation.
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic