SCS-C02 Question 404
Select 3An organization is using AWS Systems Manager Parameter Store to manage sensitive application configuration data, such as database credentials and API keys. To enhance security, the organization wants to ensure that only specific IAM roles can access these parameters, and all sensitive data is encrypted. Additionally, they want to audit access to the parameters. Which of the following steps should they take to meet these requirements?
- A
Use AWS Key Management Service (KMS) to encrypt sensitive parameters in the Parameter Store.
- B
Attach an IAM policy to the required IAM roles that grants access to specific Parameter Store parameters.
- C
Enable versioning for sensitive parameters to track changes over time.
- D
Turn on AWS CloudTrail logging to track access to the Parameter Store.
- E
Disable encryption for non-sensitive parameters to reduce costs.
Show answer and explanation
Correct answers: A, B, D
Explanation
To enhance security when using AWS Systems Manager Parameter Store with sensitive data, you should encrypt the parameters using AWS KMS, apply IAM policies for fine-grained access control, and enable AWS CloudTrail to audit access. These steps ensure the data is protected, access is restricted, and all interactions with the Parameter Store are logged for compliance and troubleshooting.
- A. Correct.
Correct: AWS KMS allows for encryption of sensitive data stored in Parameter Store, ensuring the data is encrypted at rest.
- B. Correct.
Correct: IAM policies are used to define fine-grained access control, ensuring only specific roles can access sensitive parameters.
- C. Incorrect.
Incorrect: While versioning is useful for managing changes, it is not specifically required to meet the stated security and auditing requirements.
- D. Correct.
Correct: AWS CloudTrail can be used to monitor and audit access to Parameter Store, fulfilling the auditing requirement.
- E. Incorrect.
Incorrect: Disabling encryption for non-sensitive parameters does not enhance security and is not recommended as a best practice.