Compare and Contrast Methods to Secure Connections to Providers AT0-001 Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   An organization uses a CI/CD pipeline to deploy applications to a cloud provider. The pipeline needs to list objects in a specific storage bucket and deploy code to a compute service. The security team wants to grant the pipeline the minimum permissions necessary. What should the engineer configure?

   • ACreate a new IAM role with full access to all storage buckets and compute services.
   • BUse the root account credentials for the pipeline to ensure it has all necessary permissions.
   • CAttach a custom IAM policy to the pipeline's service account that allows only the required actions on the specific bucket and compute service.
   • DAttach the built-in 'Storage Admin' and 'Compute Admin' roles to the pipeline's service account.
   Reveal Solution Discussion Select an answer first
2. 2foundation · medium

   Which tool or service is commonly used to securely store and manage access keys for automated pipelines?

   • AA shared spreadsheet
   • BA secrets manager such as AWS Secrets Manager or HashiCorp Vault
   • CA plain text file in the pipeline repository
   • DAn environment variable in the CI/CD server
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company has a CI/CD pipeline that deploys to a cloud provider. The pipeline uses a service account with a JSON key file. The security team wants to eliminate the use of long-lived keys and use short-lived credentials instead. The pipeline runs on a virtual machine that is already associated with an IAM role. What should the engineer do?

   • AUse the JSON key file but restrict its permissions to read-only.
   • BStore the JSON key file in a secrets manager and retrieve it at runtime.
   • CRemove the JSON key file and configure the SDK to use the IAM role attached to the virtual machine.
   • DKeep the JSON key file but rotate it every 30 days.
   Reveal Solution Discussion Select an answer first
5. 4foundation · medium

   Which IAM entity is specifically designed to be assumed by an AWS service, such as an EC2 instance or a Lambda function, to obtain permissions?

   • AIAM policy
   • BIAM user
   • CIAM role
   • DIAM group
   Reveal Solution Discussion Select an answer first
6. 5foundation · medium

   Which CLI configuration practice helps prevent accidental exposure of credentials in automated pipeline logs?

   • AEnabling CLI debug logging to capture all requests for troubleshooting
   • BStoring credentials in the CLI configuration file with world-readable permissions
   • CUsing the --no-verify-ssl flag to avoid certificate validation issues
   • DRedacting sensitive values in the CLI output and logs
   Reveal Solution Discussion Select an answer first