Compare and Contrast Methods to Secure Connections to Providers AT0-001 Practice Questions (Page 3)

Questions 11–15

1. 11foundation · medium

   Which authentication method is considered more secure than using static access keys for automated pipelines?

   • AUsing multi-factor authentication (MFA) for every API call
   • BUsing short-lived credentials obtained via an identity provider or IAM role
   • CUsing a certificate stored on the build server
   • DUsing a shared secret stored in the pipeline configuration
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A DevOps engineer is configuring a CI/CD pipeline that deploys infrastructure to a cloud provider. The pipeline runs on a shared build agent pool, and the team wants to avoid storing long-lived credentials in the pipeline configuration. The provider supports OpenID Connect (OIDC) federation. What should the engineer configure to authenticate the pipeline securely?

   • AUse the build agent's local user account credentials to authenticate to the cloud provider.
   • BCreate a service principal with a client secret, and configure the pipeline to use the client secret for authentication.
   • CGenerate an access key and secret for a dedicated service account, and store them as encrypted variables in the pipeline configuration.
   • DCreate an IAM role with a trust policy that allows the CI/CD platform's OIDC issuer to assume the role, and configure the pipeline to request a short-lived token for each job.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A developer is writing a Python script that uses a cloud provider's SDK to upload files to a storage service. The SDK supports multiple authentication methods. The script will run in a CI/CD pipeline that uses a service account with a JSON key file. What should the developer do to securely authenticate the SDK?

   • AUse the default application credentials without any configuration.
   • BSet the GOOGLE_APPLICATION_CREDENTIALS environment variable to the path of the JSON key file.
   • CHardcode the JSON key file contents in the script.
   • DUpload the JSON key file to the repository and reference it in the script.
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A company's CI/CD pipeline needs to securely transfer build artifacts to a cloud storage provider. The provider supports both HTTPS and SFTP. The security team mandates that data must be encrypted during transfer. Which method should the pipeline use?

   • AUse HTTP and rely on the storage provider's internal network encryption.
   • BUse plain FTP for artifact transfers.
   • CUse SFTP with a weak cipher for faster transfer speeds.
   • DUse HTTPS with TLS 1.2 or higher for all artifact transfers.
   Reveal Solution Discussion Select an answer first
6. 15foundation · medium

   Which encryption practice is used to protect sensitive data stored in a cloud provider's storage service, such as S3 or Azure Blob Storage?

   • AEncryption at rest using server-side encryption
   • BEncryption in transit using TLS
   • CHashing the data with SHA-256
   • DUsing a VPN to connect to the storage service
   Reveal Solution Discussion Select an answer first