Topic 1 Question 153
2 つ選択A company uses a custom root certificate authority certificate chain (Root CA Cert) that is 10 KB in size to generate SSL certificates for its on-premises HTTPS endpoints. One of the company’s cloud-based applications has hundreds of AWS Lambda functions that pull data from these endpoints. A developer updated the trust store of the Lambda execution environment to use the Root CA Cert when the Lambda execution environment is initialized. The developer bundled the Root CA Cert as a text file in the Lambda deployment bundle.
After 3 months of development, the Root CA Cert is no longer valid and must be updated. The developer needs a more efficient solution to update the Root CA Cert for all deployed Lambda functions. The solution must not include rebuilding or updating all Lambda functions that use the Root CA Cert. The solution must also work for all development, testing, and production environments. Each environment is managed in a separate AWS account.
Which combination of steps should the developer take to meet these requirements MOST cost-effectively?
Store the Root CA Cert as a secret in AWS Secrets Manager. Create a resource-based policy. Add IAM users to allow access to the secret.
Store the Root CA Cert as a SecureString parameter in AWS Systems Manager Parameter Store. Create a resource-based policy. Add IAM users to allow access to the policy.
Store the Root CA Cert in an Amazon S3 bucket. Create a resource-based policy to allow access to the bucket.
Refactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store inside the Lambda function handler.
Refactor the Lambda code to load the Root CA Cert from the Root CA Cert’s location. Modify the runtime trust store outside the Lambda function handler.
ユーザの投票
コメント(12)
- 正解だと思う選択肢: AE
The max size of storage in Secrets Manager is 10kb. For SSM Parameter store, it's 8Kb.
Correct options are A and E.
👍 7kiwtirApp2023/10/15 - 正解だと思う選択肢: CE
I can't see why using AWS Secrets Manager can be cost-effective, so I'm voting for C
👍 4wonder_man2023/10/27 - 正解だと思う選択肢: AD
the correct answers are (A) and (D).
Solution (A) is the most cost-effective as it uses AWS Secrets Manager, which is a managed service. The developer can simply store the root CA certificate as a secret in Secrets Manager and create a resource-based policy to allow IAM users to access the secret. This does not require any modifications to the Lambda code.
Solution (D) is also cost-effective as it does not require any modifications to the Lambda code. The developer can simply refactor the Lambda code to load the root CA certificate from the root CA certificate location. This can be done by modifying the runtime trust store outside of the Lambda function handler.
👍 2Digo30sp2023/10/06
シャッフルモード