DVA-C02 exam dumps: questions 201 to 300 of 398

Correct answer: A

• A. Correct.

  This is the correct approach. Elastic Beanstalk allows you to define environment variables in its environment configuration, which can then be accessed by the application. This keeps sensitive information out of the source code while making it manageable.

• B. Incorrect.

  This is insecure and not recommended because it exposes sensitive information to anyone with access to the source code.

• C. Incorrect.

  While AWS Secrets Manager is a secure option for storing secrets, this approach would require additional setup and is not directly supported by Elastic Beanstalk's native environment variable configuration mechanism.

• D. Incorrect.

  The EC2 instance metadata endpoint is not designed for securely retrieving application-specific secrets like database connection strings.

Correct answer: D

• A. Incorrect.

  Hardcoding sensitive data like database connection details directly in the Lambda function code is not secure and violates security best practices. It also makes it difficult to rotate credentials.

• B. Incorrect.

  While environment variables can be encrypted using AWS KMS keys, they are not the most secure option for managing sensitive data like database credentials. AWS Secrets Manager offers additional features like automatic credential rotation and fine-grained access control.

• C. Incorrect.

  Storing sensitive data in an S3 bucket is not recommended unless the data is encrypted and access is tightly controlled. Even then, it is not as secure or convenient as using AWS Secrets Manager.

• D. Correct.

  AWS Secrets Manager is the best option for storing and managing sensitive data such as database connection details. It provides features like automatic credential rotation, fine-grained permissions, and secure retrieval, making it the most secure and scalable solution.

Correct answer: C

• A. Incorrect.

  Environment variables are commonly used to store configuration data, but they are not the most secure way to manage sensitive information like database credentials. Encrypting the variables with KMS can add security, but AWS Secrets Manager is still better suited for managing sensitive secrets.

• B. Incorrect.

  Hardcoding sensitive information, such as database credentials, directly in the source code is a poor security practice and should be avoided. This approach increases the risk of accidental exposure, especially in shared repositories.

• C. Correct.

  AWS Secrets Manager is specifically designed to securely store and manage sensitive information, such as database credentials. You can retrieve the credentials at runtime using the AWS SDK, ensuring they are securely managed and rotated as needed.

• D. Incorrect.

  Storing sensitive credentials in an S3 bucket is not a secure approach, even if the bucket is private. If the bucket's permissions are misconfigured or compromised, the credentials could be exposed.

Correct answers: A, C

• A. Correct.

  This is a valid approach. Storing credentials as environment variables and encrypting them with AWS KMS ensures the credentials are securely stored and only accessible to authorized users or services.

• B. Incorrect.

  This is not a secure approach. Simply obfuscating credentials using base64 encoding does not provide true security, as encoding can easily be reversed.

• C. Correct.

  This is a valid approach. AWS Secrets Manager is specifically designed for storing and managing sensitive information like database credentials securely. The Lambda function can retrieve these credentials programmatically at runtime.

• D. Incorrect.

  Passing sensitive information like database credentials through the event payload is not secure, as it could expose the credentials in logs or to unauthorized users.

• E. Incorrect.

  Storing sensitive credentials in an Amazon S3 bucket is not recommended, even with IAM restrictions, as it is less secure compared to services like AWS Secrets Manager or Lambda environment variables with KMS encryption.

Correct answer: A

• A. Correct.

  This is the correct answer. AWS Secrets Manager is designed for securely managing secrets like database credentials, API keys, and tokens. It also supports automatic rotation of secrets and can be easily accessed by AWS Lambda at runtime using the AWS SDK or environment variables.

• B. Incorrect.

  This is not a secure practice. Embedding credentials directly in the Lambda function's environment variables increases the risk of accidental exposure and does not support automatic rotation.

• C. Incorrect.

  While AWS Systems Manager Parameter Store can securely store credentials using encrypted parameters, it does not natively provide automatic rotation of secrets, which is a crucial requirement in this scenario.

• D. Incorrect.

  Storing credentials in an S3 bucket, even if encrypted, is not a recommended practice for secrets management. S3 is not designed for managing sensitive credentials and lacks features like automatic rotation.