ExamTopics Logo
Mail Us[email protected]
Menu
Amazon Discussions
exam questions

Exam AWS Certified Developer Associate All Questions

View all questions & answers for the AWS Certified Developer Associate exam
Go to Exam

Exam AWS Certified Developer Associate topic 1 question 429 discussion

Exam question from Amazon's AWS Certified Developer Associate
Question #: 429
Topic #: 1
[All AWS Certified Developer Associate Questions]

A company uses a custom root certificate authority certificate chain (Root CA Cert) that is 10 KB in size to generate SSL certificates for its on-premises HTTPS endpoints. One of the company’s cloud-based applications has hundreds of AWS Lambda functions that pull data from these endpoints. A developer updated the trust store of the Lambda execution environment to use the Root CA Cert when the Lambda execution environment is initialized. The developer bundled the Root CA Cert as a text file in the Lambda deployment bundle.

After 3 months of development, the Root CA Cert is no longer valid and must be updated. The developer needs a more efficient solution to update the Root CA Cert for all deployed Lambda functions. The solution must not include rebuilding or updating all Lambda functions that use the Root CA Cert. The solution must also work for all development, testing, and production environments. Each environment is managed in a separate AWS account.

Which combination of steps should the developer take to meet these requirements MOST cost-effectively? (Choose two.)

  • A. Store the Root CA Cert as a secret in AWS Secrets Manager. Create a resource-based policy. Add IAM users to allow access to the secret.
  • B. Store the Root CA Cert as a SecureString parameter in AWS Systems Manager Parameter Store. Create a resource-based policy. Add IAM users to allow access to the policy.
  • C. Store the Root CA Cert in an Amazon S3 bucket. Create a resource-based policy to allow access to the bucket.
  • D. Refactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store inside the Lambda function handler.
  • E. Refactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store outside the Lambda function handler.
Show Suggested Answer Hide Answer
Suggested Answer: CE 🗳️
by KT_Yu at Jan. 21, 2023, 1:59 a.m.
Disclaimers:
  • - ExamTopics website is not related to, affiliated with, endorsed or authorized by Amazon.
  • - Trademarks, certification & product names are used for reference only and belong to Amazon.

Comments

Chosen Answer:
This is a voting comment (?). It is better to Upvote an existing comment if you don't have anything to add.
Switch to a voting comment New
Submit Cancel
KT_Yu
Highly Voted 2 years, 3 months ago
Selected Answer: CE
C and E
upvoted 7 times
pancman
2 years, 2 months ago
The solution must not include rebuilding or updating all Lambda functions that use the Root CA Cert. E violates this requirement
upvoted 2 times
...
...
Melisa202401
Most Recent 1 year, 1 month ago
This solution will meet the requirements by storing the Root CA Cert as a Secure String parameter in AWS Systems Manager Parameter Store, which is a secure and scalable service for storing and managing configuration data and secrets. The resource-based policy will allow IAM users in different AWS accounts and environments to access the parameter without requiring cross-account roles or permissions. The Lambda code will be refactored to load the Root CA Cert from the parameter store and modify the runtime trust store outside the Lambda function handler, which will improve performance and reduce latency by avoiding repeated calls to Parameter Store and trust store modifications for each invocation of the Lambda function.
upvoted 1 times
...
kyoharo
1 year, 6 months ago
Selected Answer: BE
B. Store the Root CA Cert as a SecureString parameter in AWS Systems Manager Parameter Store. Create a resource-based policy. Add IAM users to allow access to the policy. Storing the Root CA Cert as a SecureString parameter in AWS Systems Manager Parameter Store is a secure and centralized way to manage configuration data. With a resource-based policy, you can control access to the parameter, allowing IAM users or roles to retrieve the certificate as needed. E. Refactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store outside the Lambda function handler. Refactoring the Lambda code to load the Root CA Cert from the Systems Manager Parameter Store at runtime allows you to dynamically update the trust store without rebuilding or updating the Lambda functions. By modifying the runtime trust store outside the Lambda function handler, you achieve flexibility and avoid the need to redeploy the Lambda functions.
upvoted 1 times
...
gfalconia
1 year, 8 months ago
Quality of questions is pretty poor.
upvoted 2 times
...
capesignalfreer
2 years, 1 month ago
Selected Answer: CE
Not A because AWS Secrets Manager is not cost-effective. Not B because the cert is too big in size (AWS Systems Manager Parameter Store has a limit of less than 10 KB)
upvoted 1 times
...
captainpike
2 years, 1 month ago
Selected Answer: CE
IMO all options requires change in the Lamda functions. So that I am ignoring this restriction and choosing C, E
upvoted 1 times
...
pancman
2 years, 2 months ago
Selected Answer: BC
B and C
upvoted 1 times
...
AmberTheTamber
2 years, 2 months ago
Selected Answer: BC
Okay, this is a HOT mess of a question. First off, D and E require modification of the lambda function which the question stated NOT to do. So i'm not seeing why those are voted answers. Secondly, why is this a choose two question when ABC do the same thing? So if I really had to choose I would go with B and C. Parameter store costs less than secrets manger, and the s3 bucket allows you to upload the actual file.
upvoted 2 times
...
joanneli77
2 years, 2 months ago
Modify the role the Lambdas use to access secrets manager is correct. D and E are both out because of the refactoring of Lambdas. I'm personally not going to store the certificates twice, so CHOOSE ONE between ABC. This question is questionable.
upvoted 1 times
...
alforbicioni
2 years, 3 months ago
I don't get it. Ok, among A, B and C the right answer should be C (because it is the cheapest). But the question says not to modify the lambda code, so why should we refactor it? Just for the "choose two"?
upvoted 2 times
...
JuanFe
2 years, 3 months ago
for me it's b and c. I think a doesn't goes with thie question because this one is talking about cost-effectiveness. Furthermore, I think C is not the best secure option, but it meets the question
upvoted 1 times
...
tieyua
2 years, 3 months ago
Selected Answer: CE
SSM values are 4-8K depends on type
upvoted 3 times
ezeik
2 years, 2 months ago
Standard parameters have a value limit of 4 KB. Advanced parameters have a value limit of 8 KB.
upvoted 1 times
...
...
Drey
2 years, 3 months ago
Selected Answer: AC
A, C. B is not cost effective and D and E requires updating lambda functions
upvoted 3 times
tony554556
2 years, 3 months ago
A AWS Secrets Manager cost more than B AWS Systems Manager Parameter Store I guess
upvoted 1 times
tony554556
2 years, 3 months ago
C Amazon S3 bucket is even cheaper than B AWS Systems Manager Parameter Store
upvoted 1 times
...
...
tieyua
2 years, 3 months ago
Hint: When a size showed up in question for no reason, there's usually a reason ^_~
upvoted 1 times
...
...
JagpreetLM10
2 years, 3 months ago
Selected Answer: AB
A. Store the Root CA Cert as a secret in AWS Secrets Manager. Create a resource-based policy. Add IAM users to allow access to the secret. B. Store the Root CA Cert as a SecureString parameter in AWS Systems Manager Parameter Store. Create a resource-based policy. Add IAM users to allow access to the policy. By storing the Root CA Cert as a secret in AWS Secrets Manager, and then creating a resource-based policy and adding IAM users to allow access to the secret, the developer can update the Root CA Cert for all deployed Lambda functions without rebuilding or updating them. This is because the Lambda functions can reference the secret and retrieve the updated Root CA Cert. Storing the Root CA Cert as a SecureString parameter in AWS Systems Manager Parameter Store is also a good solution, as it can be accessed by the Lambda functions and updated as needed.
upvoted 2 times
...
Community vote distribution
A (35%)
C (25%)
B (20%)
Other
Most Voted
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.

SaveCancel
exam
Someone Bought Contributor Access for:
SY0-701
London, 1 minute ago