ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Security - Specialty All Questions

View all questions & answers for the AWS Certified Security - Specialty exam
Go to Exam

Exam AWS Certified Security - Specialty topic 1 question 326 discussion

Exam question from Amazon's AWS Certified Security - Specialty
Question #: 326
Topic #: 1
[All AWS Certified Security - Specialty Questions]

A company is running an Amazon RDS for MySQL DB instance in a VPC. The VPC must not send or receive network traffic through the internet.

A security engineer wants to use AWS Secrets Manager to rotate the DB instance credentials automatically. Because of a security policy, the security engineer cannot use the standard AWS Lambda function that Secrets Manager provides to rotate the credentials.

The security engineer deploys a custom Lambda function in the VPC. The custom Lambda function will be responsible for rotating the secret in Secrets Manager. The security engineer edits the DB instance's security group to allow connections from this function. When the function is invoked, the function cannot communicate with Secrets Manager to rotate the secret properly.

What should the security engineer do so that the function can rotate the secret?

  • A. Add an egress-only internet gateway to the VPC. Allow only the Lambda function's subnet to route traffic through the egress-only internet gateway.
  • B. Add a NAT gateway to the VPC. Configure only the Lambda function's subnet with a default route through the NAT gateway.
  • C. Configure a VPC peering connection to the default VPC for Secrets Manager. Configure the Lambda function's subnet to use the peering connection for routes.
  • D. Configure a Secrets Manager interface VPC endpoint. Include the Lambda function's private subnet during the configuration process.
Show Suggested Answer Hide Answer
Suggested Answer: D 🗳️
by luisfsm_111 at Nov. 19, 2022, 3:15 p.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
Toptip
1 year, 11 months ago
Selected Answer: D
D - easy one.. need "interface VPC endpoint"
upvoted 2 times
...
ITGURU51
2 years ago
The security engineer should configure a Secrets Manager interface VPC endpoint and include the Lambda function’s private subnet during the configuration process. This will allow the custom Lambda function to communicate with Secrets Manager to rotate the secret properly.
upvoted 1 times
...
nairj
2 years, 1 month ago
D : - Use of VPC Endpoint for traffic to AWS Secrets manager to be private, not through the Internet.
upvoted 2 times
...
sakibmas
2 years, 4 months ago
Selected Answer: D
You can establish a private connection between your VPC and Secrets Manager by creating an interface VPC endpoint. Interface endpoints are powered by AWS PrivateLink, a technology that enables you to privately access Secrets Manager APIs without an internet gateway, NAT device, VPN connection, or AWS Direct Connect connection. Reference: https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html
upvoted 4 times
...
Un1c0rn
2 years, 5 months ago
Selected Answer: D
C-incorrect. VPC peering has nothing to do with it. D- Correct. It should be VPC interface endpoint.
upvoted 1 times
...
AdamWest
2 years, 5 months ago
Selected Answer: D
D - Is correct VPC peering is for VRF to VRF not this.
upvoted 1 times
...
luisfsm_111
2 years, 5 months ago
Selected Answer: D
https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html
upvoted 1 times
...
luisfsm_111
2 years, 5 months ago
D looks correct: https://docs.aws.amazon.com/secretsmanager/latest/userguide/vpc-endpoint-overview.html
upvoted 1 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago