SAP-C02 · Question #6
A company runs an application on AWS. An AWS Lambda function uses credentials to authenticate to an Amazon RDS tor MySQL DB instance. A security risk assessment identified that these credentials are…
The correct answer is A. Configure the Lambda function to store and retrieve the database credentials in AWS Secrets. Parameter store can store DB credentials as secure string but CANNOT rotate secrets, hence, go with A + Cannot enable encryption on existing MySQL RDS instance, must create a new encrypted one from unencrypted snapshot…
Question
A company runs an application on AWS. An AWS Lambda function uses credentials to authenticate to an Amazon RDS tor MySQL DB instance. A security risk assessment identified that these credentials are not frequently rotated. Also, encryption at rest is not enabled for the DB instance. The security team requires that both of these issues be resolved. Which strategy should a solutions architect recommend to remediate these security risks?
Options
- AConfigure the Lambda function to store and retrieve the database credentials in AWS Secrets
- BEnable IAM DB authentication on the DB instance.
- CEnable IAM DB authentication on the DB instance.
- DConfigure the Lambda function to store and retrieve the database credentials as encrypted AWS
How the community answered
(26 responses)- A73% (19)
- B4% (1)
- C8% (2)
- D15% (4)
Explanation
Parameter store can store DB credentials as secure string but CANNOT rotate secrets, hence, go with A + Cannot enable encryption on existing MySQL RDS instance, must create a new encrypted one from unencrypted snapshot. https://docs.aws.amazon.com/secretsmanager/latest/userguide/rotating-secrets.html
Community Discussion
No community discussion yet for this question.