SCS-C02 · Question #120
A company is running an Amazon RDS for MySQL DB instance in a VPC. The VPC must not send or receive network traffic through the internet. A security engineer wants to use AWS Secrets Manager to rotate
Sign in or unlock SCS-C02 to reveal the answer and full explanation for question #120. The question stem and answer options stay visible for context.
Question
A company is running an Amazon RDS for MySQL DB instance in a VPC. The VPC must not send or receive network traffic through the internet. A security engineer wants to use AWS Secrets Manager to rotate the DB instance credentials automatically. Because of a security policy, the security engineer cannot use the standard AWS Lambda function that Secrets Manager provides to rotate the credentials. The security engineer deploys a custom Lambda function in the VPC. The custom Lambda function will be responsible for rotating the secret in Secrets Manager. The security engineer edits the DB instance's security group to allow connections from this function. When the function is invoked, the function cannot communicate with Secrets Manager to rotate the secret properly. What should the security engineer do so that the function can rotate the secret?
Options
- AAdd an egress-only internet gateway to the VPC. Allow only the Lambda function's subnet to
- BAdd a NAT gateway to the VPC. Configure only the Lambda function's subnet with a default route
- CConfigure a VPC peering connection to the default VPC for Secrets Manager. Configure the
- DConfigure a Secrets Manager interface VPC endpoint. Include the Lambda function's private
Unlock SCS-C02 to see the answer
You've previewed enough free SCS-C02 questions. Unlock SCS-C02 for full answers, explanations, the timed quiz mode, progress tracking, and the master PDF. Question stem and options stay visible so you can still see what's on the exam.