SAP-C02 Q210 · Security

Question

A company has Linux-based Amazon EC2 instances. Users must access the instances by using SSH with EC2 SSH key pairs. Each machine requires a unique EC2 key pair. The company wants to implement a key rotation policy that will, upon request, automatically rotate all the EC2 key pairs and keep the keys in a securely encrypted place. The company will accept less than 1 minute of downtime during key rotation. Which solution will meet these requirements?

Accepted Answer

**Option A: AWS Secrets Manager with Lambda-based rotation** satisfies every requirement:

1. **Secure encrypted storage**: Secrets Manager encrypts all stored secrets using AWS KMS encryption by default. This is purpose-built for storing sensitive credentials like SSH private keys.

2. **Automatic rotation upon request**: Secrets Manager has **native rotation capability** — you define a rotation schedule or trigger rotation on demand. It invokes a Lambda function that:
   - Generates a new SSH key pair
   - Replaces the public key on the EC2 instance (via SSH or Systems Manager Run Command)
   - Stores the new private key back in Secrets Manager

3. **Unique key per instance**: Each EC2 instance can have its own secret in Secrets Manager, each with its own key pair.

4. **Less than 1 minu

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

💰 Cost

🔒 Security

🎯 Exam Tips