Amazon Exam SCS-C02 Topic 7 Question 22 Discussion

Actual exam question for Amazon's SCS-C02 exam

Question #: 22
Topic #: 7

A company has a VPC that has no internet access and has the private DNS hostnames option enabled. An Amazon Aurora database is running inside the VPC. A security engineer wants to use AWS Secrets Manager to automatically rotate the credentials for the Aurora database The security engineer configures the Secrets Manager default AWS Lambda rotation function to run inside the same VPC that the Aurora database uses. However, the security engineer determines that the password cannot be rotated properly because the Lambda function cannot communicate with the Secrets Manager endpoint.

What is the MOST secure way that the security engineer can give the Lambda function the ability to communicate with the Secrets Manager endpoint?

AAdd a NAT gateway to the VPC to allow access to the Secrets Manager endpoint.

BAdd a gateway VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.

CAdd an interface VPC endpoint to the VPC to allow access to the Secrets Manager endpoint.

DAdd an internet gateway for the VPC to allow access to the Secrets Manager endpoint.

Show Suggested Answer

Suggested Answer: C

In an AWS environment where a VPC has no internet access and requires communication with AWS services such as Secrets Manager, the most secure method is to use an interface VPC endpoint (AWS PrivateLink). This allows private connectivity to services like Secrets Manager, enabling AWS Lambda functions and other resources within the VPC to access Secrets Manager without requiring an internet gateway, NAT gateway, or VPN connection. Interface VPC endpoints are powered by AWS PrivateLink, a technology that enables private connectivity between AWS services using Elastic Network Interfaces (ENI) with private IPs in your VPCs. This option is more secure than creating a NAT gateway because it doesn't expose the resources to the internet and adheres to the principle of least privilege by providing direct access to only the required service.

by Aracelis at Jun 30, 2024, 03:29 PM

Limited Time Offer

25%

Off

Get Premium SCS-C02 Questions as Interactive Web-Based Practice Test or PDF

Contribute your Thoughts:

Submit Cancel

Jolene

4 months ago

Jokes aside, the interface VPC endpoint is definitely the most secure choice here. It's the only option that keeps the VPC completely isolated while still allowing the Lambda function to access the Secrets Manager endpoint.

upvoted 0 times

...

5 months ago

Haha, I'd pick option D just to see the security engineer's face when they realize they've opened their VPC to the whole internet. But seriously, C is the way to go.

upvoted 0 times

Karan

4 months ago

Yeah, adding an interface VPC endpoint would keep the communication within the VPC and not expose it to the internet like option D would.

upvoted 0 times

...

Freeman

4 months ago

I agree, option C is definitely the most secure way to give the Lambda function access to the Secrets Manager endpoint.

upvoted 0 times

...

Ardella

6 months ago

Hmm, I'm not sure. Adding a NAT gateway seems like it could work, but it might introduce some unnecessary risks. I'd go with the interface VPC endpoint to be on the safe side.

upvoted 0 times

...

6 months ago

I think the most secure way is to add a gateway VPC endpoint to the VPC.

upvoted 0 times

...