Amazon Web Services SCS-C02 Actual Questions

Storing sensitive information in environment variables is not a secure practice, as anyone who has access to the Lambda console or the Lambda function code can view them asplaintext. To address this security issue, the security engineer needs to use a service that can store and encrypt the environment variables, and access them at runtime using IAM permissions. The most cost-effective way to do this is to use AWS Systems Manager Parameter Store, which is a service that provides secure, hierarchical storage for configuration data management and secrets management. Parameter Store allows you to store values as standard parameters (plaintext) or secure string parameters (encrypted). Secure string parameters use a AWS Key Management Service (AWS KMS) customer master key (CMK) to encrypt the parameter value. To access the parameter value at runtime, the Lambda function needs to have IAM permissions to decrypt the parameter using the KMS CMK.

The other options are incorrect because:

Option A is incorrect because setting up IAM policies from the Lambda console to hide access to the environment variables will not prevent someone who has access to the Lambda function code from viewing them as plaintext. IAM policies can only control who can perform actions on AWS resources, not what they can see in the code or the console.

Option B is incorrect because using AWS Step Functions to store the environment variables is not a secure or cost-effective solution. AWS Step Functions is a service that lets you coordinate multiple AWS services into serverless workflows. Step Functions does not provide any encryption or secrets management capabilities, and it will incur additional charges for each state transition in the workflow. Moreover, storing environment variables in Step Functions will make them visible in the execution history of the workflow, which can be accessed by anyone who has permission to view the Step Functions console or API.

Option C is incorrect because storing the environment variables in AWS Secrets Manager and accessing them at runtime is not a cost-effective solution. AWS Secrets Manager is a service that helps you protect secrets needed to access your applications, services, and IT resources. Secrets Manager enables you to rotate, manage, and retrieve secrets throughout their lifecycle. While Secrets Manager can securely store and encrypt environment variables using KMS CMKs, it will incur higher charges than Parameter Store for storing and retrieving secrets. Unless the security engineer needs the advanced features of Secrets Manager, such as automatic rotation of secrets or integration with other AWS services, Parameter Store is a cheaper and simpler option.

Comprehensive and Detailed Explanation From Exact Extract:

To mitigate traffic volume from a specific IP address without entirely blocking it, AWS WAF’s rate-based rules are the appropriate solution. AWS WAF (Web Application Firewall) provides rate-based rules that allow a user to count and limit the rate of requests from individual IP addresses.

A rate-based rule tracks the number of requests that each originating IP makes in a rolling five-minute period. If the number of requests exceeds a specified threshold, WAF applies an action such as block or count.

This makes AWS WAF an ideal tool to throttle traffic rather than block it, which directly meets the use case described.

Reference from AWS Certified Security - Specialty Official Guide:

This capability is part of AWS WAF’s standard feature set, explicitly covered under the topics of Logging and Monitoring and Mitigating DDoS and Abnormal Behavior. Rate-based rules are discussed as a method for limiting the number of incoming requests based on request patterns without denying access outright.