ExpertMinds LogoExpertMinds
Medium1 markMultiple Choice
Domain 1.1: Secure AccessRDSIAMSecurity

AWS SAA-C03 · Question 04 · Domain 1.1: Secure Access

A company is running an application on Amazon EC2 instances. The application needs to connect to an Amazon RDS for MySQL database. The company wants to avoid storing database credentials in the application code or configuration files.<br/><br/>Which solution meets these requirements MOST securely?

Answer options:

A.

Store the database credentials in an encrypted Amazon S3 bucket. Have the EC2 instances download them at startup.

B.

Enable IAM database authentication on the RDS instance. Attach an IAM role to the EC2 instances to grant access.

C.

Store the database credentials in AWS Systems Manager Parameter Store as a SecureString.

D.

Use AWS KMS to encrypt the credentials in the application code.

How to approach this question

Look for solutions that eliminate passwords entirely.

Full Answer

B.Enable IAM database authentication on the RDS instance. Attach an IAM role to the EC2 instances to grant access.✓ Correct
Enable IAM database authentication on the RDS instance. Attach an IAM role to the EC2 instances to grant access.
IAM database authentication works with MySQL and PostgreSQL. You don't need to use a password when you connect to a DB instance. Instead, you use an authentication token.

Common mistakes

Choosing Parameter Store or Secrets Manager when IAM DB authentication is an option for supported engines.
03All questions05

Practice the full AWS SAA-C03 Practice Exam 6

65 questions · hints · full answers · grading

Sign up freeTake the exam

More questions from this exam

Q01A company has multiple AWS accounts in an AWS Organizations organization. The security team wants...MediumQ02A company has two AWS accounts: Account A for development and Account B for production. Developer...MediumQ03A mobile application needs to authenticate users using their social media accounts (Facebook, Goo...EasyQ05A company has 50 AWS accounts managed by AWS Organizations. The IT team wants to implement a cent...EasyQ06A company wants to restrict access to an Amazon S3 bucket so that only requests originating from ...Medium
View all 65 questions →