Compare and Contrast Methods to Secure Connections to Providers AT0-001 Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   A DevOps engineer is configuring a CLI tool for a CI/CD pipeline. The CLI tool supports multiple authentication methods, including environment variables, a shared credentials file, and IAM roles. The pipeline runs on a shared build agent that also runs other jobs. The security team wants to ensure that the pipeline's credentials are not accessible to other jobs running on the same agent. What should the engineer do?

   • AUse environment variables that are set only for the specific pipeline job, and ensure the CLI tool reads credentials from those variables.
   • BHardcode the credentials in the pipeline script.
   • CUse a shared credentials file that is readable by all jobs on the agent.
   • DUse the IAM role attached to the build agent, which is shared by all jobs.
   Reveal Solution Discussion Select an answer first
2. 27expert · hard

   A security audit reveals that a CI/CD pipeline's IAM role has a policy that allows 'ec2:*' on all resources. The pipeline only needs to start and stop specific EC2 instances. The security team wants to enforce least privilege without breaking the pipeline. What should the engineer do?

   • AKeep the policy as is but add a condition that restricts access to certain times of day.
   • BCreate a new IAM role with the same policy and use it for the pipeline.
   • CModify the IAM policy to allow only 'ec2:StartInstances' and 'ec2:StopInstances' on the specific instance IDs used by the pipeline.
   • DUse the root account for the pipeline to avoid policy complexity.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A company's CI/CD pipeline uses a cloud provider's SDK to deploy applications. The SDK supports authentication via environment variables, a shared credentials file, or IAM roles. The pipeline runs on a Kubernetes cluster with workload identity enabled. The security team wants to avoid managing long-lived credentials. What should the engineer configure?

   • AConfigure the Kubernetes workload to use workload identity, which allows the SDK to automatically obtain short-lived credentials from the cloud provider.
   • BMount a shared credentials file into the Kubernetes pod.
   • CHardcode the access key and secret in the SDK script.
   • DSet environment variables with long-lived access keys in the Kubernetes deployment.
   Reveal Solution Discussion Select an answer first
5. 29application · medium

   A DevOps engineer is setting up a CI/CD pipeline that needs to authenticate to a cloud provider using an access key. The security team requires that the access key be rotated every 30 days and that the rotation process be automated. What should the engineer implement?

   • AStore the access key in the pipeline configuration and manually rotate it every 30 days.
   • BUse a secrets management service to store the access key and configure a scheduled function to rotate it every 30 days.
   • CCreate a new access key every time the pipeline runs and delete the old one.
   • DDisable rotation and use a long-lived access key to avoid downtime.
   Reveal Solution Discussion Select an answer first
6. 30foundation · medium

   Which SDK configuration option ensures that data transmitted between the SDK and the cloud provider is encrypted?

   • ADisabling certificate validation to avoid errors
   • BUsing a custom DNS resolver to bypass network restrictions
   • CEnabling TLS/SSL verification in the SDK's HTTP client
   • DSetting the endpoint URL to use HTTP instead of HTTPS
   Reveal Solution Discussion Select an answer first