Q77 — AWS SAA-C03 Ch.17

Question 77 of 89 | ← Chapter 17

Q1377. A company has an application that runs on Amazon EC2 instances and uses an Amazon Aurora database. The EC2 instances connect to the Aurora database by using user names and passwords that the company stores locally in a file.The company changes the user names and passwords every month. The company wants to minimize the operational overhead of credential management.Which solution will meet these requirements?

• A. Store the credentials as a secret within AWS Secrets Manager. Assign IAM permissions to the secret.Reconfigure the application to call the secret. Enable rotation on the secret and configure rotation to occur on a monthly schedule. ✓
• B. The company changes the user names and passwords every month. The company wants to minimize the operational overhead of credential management. To the parameter. Reconfigure the application to access the parameter.
• C. Create an Amazon S3 bucket to store objects. Use an AWS KMS key to encrypt the objects. Migrate the credentials file to the S3 bucket. Update the application to retrieve the credentials file from the S3 bucket.
• D. Create an encrypted Amazon EBS volume for each EC2 instance. Attach the encrypted EBS volumes to the EC2 instances. Migrate the credentials file to the new EBS volumes. Point the application to the encrypted EBS volumes.

Correct Answer: A. Store the credentials as a secret within AWS Secrets Manager. Assign IAM permissions to the secret.Reconfigure the application to call the secret. Enable rotation on the secret and configure rotation to occur on a monthly schedule.

Explanation

Let's analyze each option to determine which one meets the requirement of minimizing the operational overhead of credential management for the application connecting to an Amazon Aurora database:Option AAWS Secrets Manager: AWS Secrets Manager is a fully - managed service that helps you protect access to your applications, services, and IT resources. It allows you to store and manage secrets such as database credentials securely.IAM permissions: By assigning IAM permissions to the secret, you can control which EC2 instances or users have access to the credentials. This provides a fine - grained access control mechanism. Application reconfiguration: Reconfiguring the application to call the secret means that the application can retrieve the latest credentials whenever needed without hard - coding them. Rotation: Enabling rotation on the secret and configuring it to occur on a monthly schedule automates the process of changing the user names and passwords. This eliminates the need for manual intervention every month, significantly reducing the operational overhead of credential management. So, this option is correct.Option BThe description of this option is incomplete. It mentions adding the credentials to a parameter but does not specify what kind of parameter (e.g., AWS Systems Manager Parameter Store). Also, it does not address the rotation of credentials, which is a key requirement as the company changes the user names and passwords every month. Without rotation, the operational overhead of manual credential updates remains.So, this option is incorrect.Option CAmazon S3 for storage: While using an Amazon S3 bucket with an AWS KMS key to encrypt the objects provides a way to store the credentials file securely, it does not automate the rotation of credentials. The company would still need to manually update the credentials file in the S3 bucket every month, which does not minimize the operational overhead as required. So, this option is incorrect.Option DEncrypted Amazon EBS volumes: Creating encrypted Amazon EBS volumes for each EC2 instance and migrating the credentials file to these volumes provides local storage for the credentials. However, similar to Option C, it does not automate the rotation of credentials. The company would have to manually update the credentials on each EBS volume every month, which is not an efficient way to manage credentials and does not reduce the operational overhead. So, this option is incorrect. Therefore, the solution that will meet the requirements is to store the credentials as a secret within AWS Secrets Manager, assign IAM permissions to the secret, reconfigure the application to call the secret, enable rotation on the secret, and configure rotation to occur on a monthly schedule, and the answer is A.