Examkin

Question

Difficulty: EasyData Encryption and Key Management

A company is deploying an application that requires access to a database password. The company's security policy mandates that this database password must be encrypted at rest and automatically rotated every 30 days. Which combination of steps should a solutions architect take to meet these requirements? (Select TWO.)

  1. Store the database password in AWS Secrets Manager.Answer
  2. Enable automatic rotation in AWS Secrets Manager and configure an AWS Lambda function to update the database credentials.Answer
  3. C
    Store the database password as a String parameter in AWS Systems Manager Parameter Store.
  4. D
    Store the database password as a SecureString parameter in AWS Systems Manager Parameter Store and configure Parameter Store automatic rotation.
  5. E
    Store the database password in AWS Secrets Manager and rely on AWS KMS automatic key rotation to update the database password value.

Answer

The database password must be stored in AWS Secrets Manager, with automatic rotation enabled using an AWS Lambda function.
AWS Secrets Manager provides built-in encryption at rest and integrates with AWS Lambda to automatically rotate database credentials on a schedule.

Step-by-Step Solution

1
Select the storage service that supports secret rotation.
AWS Secrets Manager is chosen.
Systems Manager Parameter Store lacks a native automated rotation mechanism.
2
Implement the rotation logic.
An AWS Lambda function is configured to update the secret and the target database.
Secrets Manager uses Lambda to securely rotate database credentials.

Key Concept

Credential Storage and Automated Rotation in AWS
Rate this question

Topics

Data Encryption and Key Management

More questions from this topic