ExpertAWS SAP-C02 · Question 30 · Domain 2.3: Security Controls
A company is deploying a new application using AWS CloudFormation. They need to ensure that sensitive parameters, such as database passwords, are not hardcoded in the templates and are rotated automatically every 30 days. Which THREE actions should they take? (Select THREE)
A company is deploying a new application using AWS CloudFormation. They need to ensure that sensitive parameters, such as database passwords, are not hardcoded in the templates and are rotated automatically every 30 days. Which THREE actions should they take? (Select THREE)
Answer options:
Store the passwords in AWS Systems Manager Parameter Store as SecureString.
Store the passwords in AWS Secrets Manager.
Use CloudFormation parameters with NoEcho set to true to pass passwords during stack creation.
Configure an AWS Lambda function to handle the rotation logic for Secrets Manager.
Hardcode the passwords in a private S3 bucket and reference them in CloudFormation.
Use dynamic references in the CloudFormation template to retrieve the secrets from Secrets Manager.
Use AWS KMS to rotate the passwords.
How to approach this question
Full Answer
Common mistakes
Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 2
75 questions · hints · full answers · grading