Exam AWS Certified Solutions Architect - Professional topic 1 question 1006 discussion

Exam question from Amazon's AWS Certified Solutions Architect - Professional

Question #: 1006
Topic #: 1

[All AWS Certified Solutions Architect - Professional Questions]

A solutions architect is auditing the security setup of an AWS Lambda function for a company. The Lambda function retrieves the latest changes from an Amazon Aurora database. The Lambda function and the database run in the same VPC. Lambda environment variables are providing the database credentials to the Lambda function.

The Lambda function aggregates data and makes the data available in an Amazon S3 bucket that is configured for server-side encryption with AWS KMS managed encryption keys (SSE-KMS). The data must not travel across the internet. If any database credentials become compromised, the company needs a solution that minimizes the impact of the compromise.

What should the solutions architect recommend to meet these requirements?

A. Enable IAM database authentication on the Aurora DB cluster. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authentication. Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
B. Enable IAM database authentication on the Aurora DB cluster. Change the IAM role for the Lambda function to allow the function to access the database by using IAM database authentication. Enforce HTTPS on the connection to Amazon S3 during data transfers.
C. Save the database credentials in AWS Systems Manager Parameter Store. Set up password rotation on the credentials in Parameter Store. Change the IAM role for the Lambda function to allow the function to access Parameter Store. Modify the Lambda function to retrieve the credentials from Parameter Store. Deploy a gateway VPC endpoint for Amazon S3 in the VPC.
D. Save the database credentials in AWS Secrets Manager. Set up password rotation on the credentials in Secrets Manager. Change the IAM role for the Lambda function to allow the function to access Secrets Manager. Modify the Lambda function to retrieve the credentials Om Secrets Manager. Enforce HTTPS on the connection to Amazon S3 during data transfers.

Show Suggested Answer

Suggested Answer: A 🗳️

by Spavanko at Nov. 29, 2022, 7:33 p.m.

Disclaimers:

- ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
- Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Submit Cancel

Spavanko

Highly Voted 2 years, 5 months ago

Selected Answer: A

The correct answer is A: It is passwordless and provides VPC Gateway for S3 data transfer to avoid traffic over the internet. Answer C is incorrect because AWS Systems Manager Parameter Store can not rotate passwords.

upvoted 9 times

...

ggrodskiy

Highly Voted 2 years, 4 months ago

Correct A. The data must not travel across the internet

upvoted 5 times

...

ggrodskiy

Most Recent 2 years, 4 months ago

https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/UsingWithRDS.IAMDBAuth.html

upvoted 1 times

...

sly353

2 years, 5 months ago

Why would it not be D? I think the answer is .. https://aws.amazon.com/blogs/security/how-to-securely-provide-database-credentials-to-lambda-functions-by-using-aws-secrets-manager/

upvoted 4 times

Amac1979

2 years, 2 months ago

Because HTTPS still going thru internet.

upvoted 1 times

...

Exam AWS Certified Solutions Architect - Professional All Questions

View all questions & answers for the AWS Certified Solutions Architect - Professional exam

Exam AWS Certified Solutions Architect - Professional topic 1 question 1006 discussion

Comments

Spavanko

ggrodskiy

ggrodskiy

sly353

Amac1979

SY0-701