SAP-C02 Q242 · Security

Question

During an audit, a security team discovered that a development team was putting IAM user secret access keys in their code and then committing it to an AWS CodeCommit repository. The security team wants to automatically find and remediate instances of this security vulnerability. Which solution will ensure that the credentials are appropriately secured automatically?

Accepted Answer

**Option D** is correct because it addresses every requirement in the question:

1. **Automatic detection**: A CodeCommit trigger fires **immediately** when new code is pushed to the repository. This is event-driven — no delay, no scheduled scans.

2. **Scanning for credentials**: The triggered Lambda function can scan the diff or new code submissions for patterns matching IAM access keys (e.g., strings starting with `AKIA` for access key IDs, or long alphanumeric strings for secret keys).

3. **Automatic remediation**: When credentials are found, the Lambda function **disables the IAM access key** using the `iam:UpdateAccessKey` API with `Status=Inactive`. This is the correct remediation — you don't rotate or store the exposed credential; you **disable** it immediately because it's alread

📖 Explanation

✅ Correct Answer

❌ Wrong Answers

📘 Key Concepts

🏗️ Architecture

⚙️ Operations

🔒 Security

🎯 Exam Tips