DEA-C01 practice question: Credentials and secrets (2 of 2)
Data Security and Governance A free question from our original DEA-C01 practice exam. Try it, then open the answer to see why each option is right or wrong.
A market-research firm runs 60 data pipelines, and each pipeline needs a handful of configuration values. Some values are sensitive, such as the API keys for three data vendors, but none of the keys has to rotate automatically. The team wants the lowest cost for storing about 300 values, and the values must be encrypted at rest and readable only by each pipeline's role.
Which solution meets these requirements?
Choose one answer.
AA. Store each value as a separate AWS Secrets Manager secret, and turn on rotation for every one of them.
BB. Store the values as plain-text objects in one S3 bucket, and rely on the bucket's default encryption and a shared read policy for all pipelines.
CC. Store each value as a SecureString parameter in Parameter Store, encrypted with KMS, with read access per pipeline path.
DD. Write the values into each pipeline's environment variables in the CloudFormation template, so they are not stored in any service.
Show the answer and explanation
Answer: C
A. Wrong: Secrets Manager charges for each secret, so 300 secrets cost far more than the team needs. Rotation adds Lambda work for keys that do not need to change, which the team does not want.
B. Wrong: Plain-text objects are not designed for secrets, and a shared read policy lets every pipeline read every value. The option fails the per-role access requirement.
C. Right: Correct. SecureString parameters are encrypted with KMS and cost less than a Secrets Manager secret for each value, and they fit values that do not rotate. Per-path IAM policies keep each pipeline's values separate. Learn more: AWS Systems Manager Parameter Store (opens in a new tab)
D. Wrong: Values in templates are visible to anyone who can read the stack, and they are stored in plain text in the template. The option fails both the encryption and access requirements.
Explanation
Parameter Store SecureString parameters encrypt sensitive values with KMS and cost much less than a Secrets Manager secret for each value. Secrets Manager's automatic rotation is worth paying for only when a credential must change on a schedule, which these keys do not. Per-path policies keep each pipeline's values to itself, while plain files and templates expose the values.
Want more on Credentials and secrets? The 5 full-length practice sets have 9 more Credentials and secrets questions, 325 in all, none of them in the free exam. One payment of $14.99, no subscription. See the practice sets →