Free AWS-CERTIFIED-DEVELOPER-ASSOCIATE-DVA-C02 Amazon AWS-CERTIFIED-DEVELOPER-ASSOCIATE-DVA-C02 Practice Test Question - Page 6

Question 16 (Topic 1)

A developer is creating an application for a company. The application needs to read the file doc.txt that is placed in the root folder of an Amazon S3 bucket that is named DOC-EXAMPLE-BUCKET. The company’s security team requires the principle of least privilege to be applied to the application’s IAM policy. Which IAM policy statement will meet these security requirements?

Select an option, then click Submit answer.

Question 17 (Topic 1)

A company is using Amazon OpenSearch Service to implement an audit monitoring system. A developer needs to create an AWS CloudFormation custom resource that is associated with an AWS Lambda function to configure the OpenSearch Service domain. The Lambda function must access the OpenSearch Service domain by using OpenSearch Service internal master user credentials. What is the MOST secure way to pass these credentials to the Lambda function?

Select an option, then click Submit answer.

○ Use a CloudFormation parameter to pass the master user credentials at deployment to the OpenSearch Service domain’s MasterUserOptions and the Lambda function’s environment variable. Set the NoEcho attribute to true.
○ Use a CloudFormation parameter to pass the master user credentials at deployment to the OpenSearch Service domain’s MasterUserOptions and to create a parameter in AWS Systems Manager Parameter Store. Set the NoEcho attribute to true. Create an IAM role that has the ssm:GetParameter permission. Assign the role to the Lambda function. Store the parameter name as the Lambda function’s environment variable. Resolve the parameter’s value at runtime.
○ Use a CloudFormation parameter to pass the master user credentials at deployment to the OpenSearch Service domain’s MasterUserOptions and the Lambda function’s environment variable. Encrypt the parameter’s value by using the AWS Key Management Service (AWS KMS) encrypt command.
○ Use CloudFormation to create an AWS Secrets Manager secret. Use a CloudFormation dynamic reference to retrieve the secret’s value for the OpenSearch Service domain’s MasterUserOptions. Create an IAM role that has the secretsmanager:GetSecretValue permission. Assign the role to the Lambda function. Store the secret’s name as the Lambda function’s environment variable. Resolve the secret’s value at runtime.

Reference / correct answer:

Use CloudFormation to create an AWS Secrets Manager secret. Use a CloudFormation dynamic reference to retrieve the secret’s value for the OpenSearch Service domain’s MasterUserOptions. Create an IAM role that has the secretsmanager:GetSecretValue permission. Assign the role to the Lambda function. Store the secret’s name as the Lambda function’s environment variable. Resolve the secret’s value at runtime.

Most accepted answer: D. Use CloudFormation to create an AWS Secrets Manager secret. Use a CloudFormation dynamic reference to retrieve the secret’s value for the OpenSearch Service domain’s MasterUserOptions. Create an IAM role that has the secretsmanager:GetSecretValue permission. Assign the role to the Lambda function. Store the secret’s name as the Lambda function’s environment variable. Resolve the secret’s value at runtime.

Community votes: D=4

Selected Answer: D D is the correct answer. upvoted 2 times

Selected Answer: D This approach is the most secure and aligns with best practices for managing secrets. The credentials are stored in AWS Secrets Manager, which is specifically designed for managing and protecting secrets. The credentials are retrieved dynamically at runtime by the Lambda function, and the use of IAM roles ensures that only the Lambda function has access to these secrets. This method also benefits from the security and rotation features of AWS Secrets Manager. upvoted 2 times

Selected Answer: D D is correct. upvoted 2 times

Selected Answer: D The correct answer is (D). Solution (D) is the most secure way to pass the credentials to the Lambda function because it uses AWS Secrets Manager to store the credentials in encrypted form. upvoted 3 times

Question 18 (Topic 1)

A company is using Amazon RDS as the backend database for its application. After a recent marketing campaign, a surge of read requests to the database increased the latency of data retrieval from the database. The company has decided to implement a caching layer in front of the database. The cached content must be encrypted and must be highly available. Which solution will meet these requirements?

Select an option, then click Submit answer.

○ Amazon CloudFront
○ Amazon ElastiCache for Memcached
○ Amazon ElastiCache for Redis in cluster mode
○ Amazon DynamoDB Accelerator (DAX)

Free AWS-CERTIFIED-DEVELOPER-ASSOCIATE-DVA-C02 – Amazon AWS-CERTIFIED-DEVELOPER-ASSOCIATE-DVA-C02 Practice Test Question