Compare and Contrast Methods to Secure Connections to Providers AT0-001 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A software team is writing a script that uses a cloud provider's SDK to automate deployments. The SDK supports reading credentials from environment variables, a shared credentials file, or IAM roles. The script will run on a CI/CD runner that is already associated with an IAM role. Which method should the script use to obtain credentials?

   • ALet the SDK automatically use the IAM role attached to the runner.
   • BHardcode the access key and secret in the script.
   • CSet environment variables with long-lived access keys.
   • DCreate a shared credentials file with the access key and secret.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A CI/CD pipeline uses a CLI tool to deploy applications. The CLI tool supports configuration files, environment variables, and command-line flags. The security team wants to ensure that credentials are not stored in the repository. What should the engineer configure?

   • AStore credentials in a configuration file that is committed to the repository.
   • BUse environment variables to pass credentials to the CLI at runtime.
   • CHardcode credentials in the CLI script.
   • DPass credentials as command-line flags in the pipeline script.
   Reveal Solution Discussion Select an answer first
4. 23foundation · medium

   A DevOps engineer wants to configure the AWS CLI to securely authenticate to AWS from an automated pipeline. Which CLI setting is the recommended way to provide credentials without hardcoding them in scripts?

   • AConfiguring the CLI to use IAM roles or temporary credentials via the AWS_SECURITY_TOKEN environment variable
   • BSetting the AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY environment variables in the pipeline configuration
   • CUsing the aws configure command to store credentials in the default profile of the shared credentials file
   • DUsing the AWS CLI's built-in support for IAM roles by setting the AWS_PROFILE environment variable to a profile that assumes a role
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A company's CI/CD pipeline needs to authenticate to a third-party API. The API supports API keys, OAuth2 client credentials, and mutual TLS. The security team wants to use a method that does not require sharing a secret with the API provider and provides strong authentication. Which method should the engineer choose?

   • AUse an API key that is shared with the provider.
   • BUse mutual TLS (mTLS) with a client certificate.
   • CUse basic authentication with a username and password.
   • DUse OAuth2 client credentials with a client secret.
   Reveal Solution Discussion Select an answer first
6. 25foundation · medium

   Which IAM policy principle states that a user or role should be granted only the permissions necessary to perform their job functions?

   • ASeparation of duties
   • BDefense in depth
   • CFail-safe defaults
   • DLeast privilege
   Reveal Solution Discussion Select an answer first