Preparing Practice Exam…
Please wait a moment while the system generates the exam questions, answers, and study session.
Please wait a moment while the system generates the exam questions, answers, and study session.
AWS Certified Developer - Associate · AWS
Select one answer.
Written by other learners. Comments can disagree with the marked answer — check the official documentation when in doubt.
With option A, if you want to know what secrets are not used anymore for the past 90 days, then you need to wait 90 days, get a list of the ones that are used then minus this from the total list... but option B returns the unused list for the last 90 days directly
source copilot: Why Option A is Better: 1. Real-Time Monitoring: By using CloudTrail and CloudWatch, you can monitor GetSecretValue API calls in real-time, providing immediate insights into which secrets are being accessed. 2. Detailed Logging: CloudTrail logs provide detailed information about each API call, including the source IP, user, and timestamp, which can help identify the specific applications or instances accessing the secrets. 3. Customizable Alerts: CloudWatch alarms can be configured to trigger notifications based on specific patterns or thresholds, offering more flexibility and control over monitoring.
Why Option B Might Not Be the Best Choice: 1. Rule Limitation: The secretsmanager-secret-unused AWS Config managed rule checks if a secret has not been retrieved for a specified period. However, it might not provide real-time insights into which secrets are currently in use. 2. Delayed Detection: This rule might only detect secrets that have not been used for a while, potentially missing secrets that are infrequently accessed but still required. 3. Lack of Granularity: The rule might not provide detailed information about the specific applications or instances accessing the secrets, making it harder to pinpoint which secrets are actively used.