Examkin

Soru

Zorluk: KolaySecrets and Parameter Management

A company is moving an on-premises application to Amazon EC2. The application needs to retrieve a sensitive API credential for an external payment service and a non-sensitive API endpoint URL for a weather forecasting service. A solutions architect needs to design a configuration storage strategy that is secure, cost-effective, and minimizes administrative overhead.

Which combination of steps should the solutions architect take to meet these requirements? (Select TWO.)

  1. Store the payment service API credential as a SecureString parameter in AWS Systems Manager Parameter Store.Cevap
  2. Store the weather forecasting service API endpoint URL as a String parameter in AWS Systems Manager Parameter Store.Cevap
  3. C
    Store the payment service API credential as a String parameter in AWS Systems Manager Parameter Store.
  4. D
    Store the weather forecasting service API endpoint URL as a SecureString parameter and configure AWS KMS to automatically rotate the parameter value every 24 hours.
  5. E
    Store the payment service API credential as a String parameter in AWS Systems Manager Parameter Store and enable KMS automatic key rotation to automatically update the credential value.

Cevap

Store the payment service API credential as a SecureString parameter in AWS Systems Manager Parameter Store, and store the weather forecasting service API endpoint URL as a String parameter in AWS Systems Manager Parameter Store.
Storing the sensitive payment service API credential as a SecureString parameter in Systems Manager Parameter Store provides automatic encryption at rest using AWS KMS. Storing the non-sensitive weather forecasting service API endpoint URL as a standard String parameter in Parameter Store is the most secure and cost-effective approach, avoiding unnecessary KMS costs while utilizing a centralized parameter management solution.

Adım Adım Çözüm

1
Identify the sensitivity of the configuration data.
The payment service API credential is sensitive and requires encryption, while the weather forecasting service API endpoint is non-sensitive.
This determines which storage parameters require encryption and which can be stored in plaintext.
2
Select the appropriate parameter type in AWS Systems Manager Parameter Store.
Use a SecureString parameter for the sensitive credential to encrypt it at rest using AWS KMS, and use a standard String parameter for the non-sensitive URL endpoint to save on overhead and encryption resource costs.
This implements the principle of least privilege and optimizes cost and management overhead.

Anahtar Kavram

AWS Systems Manager Parameter Store supports String parameters for plaintext configurations and SecureString parameters for sensitive configuration data encrypted by AWS KMS.
Bu soruyu puanla

Konular

Secrets and Parameter Management

Bu konudan daha fazla soru