AWS Certified Security - Specialty SCS-C02 — Topic 1 Question 50

Question

A security engineer is checking an AWS CloudFormation template for vulnerabilities. The security engineer finds a parameter that has a default value that exposes an application's API key in plaintext. The parameter is referenced several times throughout the template. The security engineer must replace the parameter while maintaining the ability to reference the value in the template. Which solution will meet these requirements in the MOST secure way?

Accepted Answer

Correct answer: B. The correct answer is B. Option B: Store the API key value in AWS Secrets Manager. In the template, replace all references to the value with {{resolve:secretsmanager:MySecretId:SecretString}}. AWS Secrets Manager stores and automatically rotates secrets such as database credentials.

AWS Certified Security - Specialty SCS-C02 — Question 50