Task 3: Manage Sensitive Data in Application Code DVA-C02 Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer is deploying a Node.js application to AWS Elastic Beanstalk. The application needs a database password to connect to Amazon RDS. The developer wants to avoid storing the plaintext password in the environment variables visible in the Elastic Beanstalk console. What is the most secure way to manage this password?

   • AEncrypt the password using a KMS key and store the encrypted blob in the environment variable, then decrypt it in the application code.
   • BUse AWS Secrets Manager to store the password and retrieve it at runtime in the application code using the AWS SDK.
   • CStore the password in a plaintext environment variable in the Elastic Beanstalk configuration and restrict console access to the developer.
   • DHardcode the password in the application source code and commit it to the private repository.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Which AWS service is designed to securely store, retrieve, and automatically rotate database credentials and other secrets?

   • AAWS Identity and Access Management (IAM)
   • BAWS Systems Manager Parameter Store
   • CAWS Key Management Service (KMS)
   • DAWS Secrets Manager
   Reveal Solution Discussion Select an answer first
4. 13application · hard

   A developer is designing a multi-tenant application that uses Amazon S3 to store user-uploaded documents. Each tenant has a unique identifier. What is the most secure way to store and manage access to these documents?

   • AEncrypt all documents with a single AWS KMS key and share the key with all tenants.
   • BStore all documents in a single S3 bucket and rely on the application to check the tenant ID in the object key before returning it.
   • CStore all documents in a single S3 bucket and use a prefix based on the tenant ID (e.g., s3://bucket/tenant-123/document.pdf).
   • DCreate a separate S3 bucket for each tenant and use IAM policies to grant each tenant's IAM role access only to their bucket.
   Reveal Solution Discussion Select an answer first
5. 14application · easy

   A developer is migrating a legacy application to AWS. The application currently reads a database password from a local configuration file. The developer wants to use AWS Secrets Manager. What is the first step the developer should take to integrate Secrets Manager?

   • ACreate a new secret in Secrets Manager and store the database password in it.
   • BDelete the local configuration file to ensure the password is not exposed.
   • CSet up IAM permissions for the application to access Secrets Manager.
   • DModify the application code to call the AWS SDK to retrieve the secret from Secrets Manager.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a primary implication of classifying data as PII (Personally Identifiable Information) in an application?

   • AThe data must be encrypted using a customer-managed key.
   • BThe data must be publicly accessible for transparency.
   • CThe data requires appropriate access controls and protection against unauthorized disclosure.
   • DThe data must be stored in a separate AWS account.
   Reveal Solution Discussion Select an answer first