A company is designing a highly secure environment on AWS. They need to store sensitive database credentials. The credentials must be rotated automatically every 30 days. The application running on EC2 needs to retrieve these credentials securely without hardcoding them. Which combination of steps should be taken? (Select TWO)

Answer options:

A.

Store the credentials in AWS Systems Manager Parameter Store as a SecureString.

B.

Store the credentials in AWS Secrets Manager and configure automatic rotation.

C.

Assign an IAM role to the EC2 instance with permissions to read the secret from Secrets Manager.

D.

Store the credentials in an encrypted S3 bucket.

E.

Embed the credentials in the AMI used by the EC2 instances.

F.

Use AWS KMS to rotate the credentials.

How to approach this question

Identify the service for secret rotation and the method for secure access.

Full Answer

AWS Secrets Manager is designed specifically for storing and automatically rotating secrets like database credentials. EC2 instances should use IAM roles (instance profiles) to securely retrieve these secrets via the API.

Common mistakes

Choosing Parameter Store, which lacks native automatic rotation capabilities.

Question 59 All questions Question 61

Practice the full AWS Solutions Architect Professional SAP-C02 Practice Exam 7

75 questions · hints · full answers · grading

Sign up free Take the exam

More questions from this exam

Q01A global enterprise is designing a multi-region network architecture connecting 50 AWS accounts a...Hard Q02A company is migrating its hybrid network to AWS. They have two 10 Gbps AWS Direct Connect connec...Hard Q03An enterprise has 100 AWS accounts in AWS Organizations. The security team mandates that all Amaz...Medium Q04A financial company requires that all EBS volumes, S3 buckets, and RDS databases be encrypted usi...Easy Q05An enterprise is designing a disaster recovery strategy for a critical application running on Ama...Hard

View all 75 questions →