SCS-C02 Question 407
Select 2A company uses AWS Systems Manager Parameter Store to store sensitive database credentials as SecureString parameters. The security team wants to ensure that these credentials are protected from unauthorized access and that any access to the parameters is logged for auditing purposes. Which combination of actions should the company take to meet these requirements? (Select TWO.)
- A
Configure AWS Key Management Service (KMS) to encrypt the SecureString parameters.
- B
Enable AWS CloudTrail to monitor and log access to the Parameter Store.
- C
Use a Lambda function to rotate the SecureString parameters periodically.
- D
Restrict access to the Parameter Store using IAM policies.
- E
Enable Multi-Factor Authentication (MFA) for accessing Parameter Store.
Show answer and explanation
Correct answers: A, B
Explanation
To meet the requirements of protecting sensitive database credentials and ensuring access is logged, the company should use AWS KMS to encrypt SecureString parameters and enable AWS CloudTrail for auditing access to Parameter Store. These actions ensure encryption of sensitive data at rest and provide a trail of access activity.
- A. Correct.
Correct: SecureString parameters in Parameter Store are encrypted using AWS KMS. Configuring KMS ensures the sensitive data is encrypted at rest.
- B. Correct.
Correct: AWS CloudTrail logs API calls to Systems Manager Parameter Store, which helps monitor and audit access to sensitive parameters.
- C. Incorrect.
Incorrect: While parameter rotation is a good practice, it is not directly related to protecting access or logging actions in Parameter Store.
- D. Incorrect.
Incorrect: IAM policies are important for access control, but they alone do not ensure encryption or logging for auditing purposes.
- E. Incorrect.
Incorrect: MFA cannot be directly implemented for accessing Parameter Store. Access is managed through IAM policies.