A Company Has an Application That Calls AWS Lambda Functions

question 381

Multiple Choice

A company has an application that calls AWS Lambda functions. A recent code review found database credentials stored in the source code. The database credentials need to be removed from the Lambda source code. The credentials must then be securely stored and rotated on an ongoing basis to meet security policy requirements. What should a solutions architect recommend to meet these requirements?

• A) Store the password in AWS CloudHSM. Associate the Lambda function with a role that can retrieve the password from CloudHSM given its key ID.
• B) Store the password in AWS Secrets Manager. Associate the Lambda function with a role that can retrieve the password from Secrets Manager given its secret ID.
• C) Move the database password to an environment variable associated with the Lambda function. Retrieve the password from the environment variable upon execution.
• D) Store the password in AWS Key Management Service (AWS KMS). Associate the Lambda function with a role that can retrieve the password from AWS KMS given its key ID.

---

Definitions:

Maximum Loss

The greatest potential loss one could incur in an investment or trading position.

2-For-1 Split

A stock split where for each share owned, a shareholder receives an additional share, effectively doubling the number of shares.

Premium

The amount paid for an option or insurance policy above its intrinsic value or the amount that an asset's selling price is above its face value.

Gross Profit

The difference between sales revenue and the cost of goods sold before deducting overhead, payroll, taxation, and interest payments.