Secret Management Tools ECDE Practice Questions (Page 1)

Questions 1–5

1. 1expert · hard

   A security team is implementing secret rotation for a service account used by a batch job that runs every hour. The rotation policy must ensure that the service account password is rotated every 30 days, but the batch job must not fail due to a rotated password. The job reads the password from a file at startup. What is the best approach?

   • ADisable rotation for this service account to avoid job failures.
   • BUse a secret manager that supports versioning and have the batch job read the latest version at each run.
   • CRotate the password in the secret manager and update the file, then restart the batch job immediately.
   • DRotate the password manually and update the file during a maintenance window.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   A company discovers that a database password has been exposed in a public GitHub repository for the past six months. The password is used by multiple applications. What is the FIRST action the team should take?

   • AContact GitHub to have the repository taken down.
   • BRemove the password from the repository and rewrite the git history to purge it.
   • CRotate the database password immediately to invalidate the exposed credential.
   • DRun a secret scanner on the repository to identify other exposed secrets.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security auditor requires that all access to secrets in AWS Secrets Manager be logged, including who accessed the secret and from which IP address. Which service should be used to meet this requirement?

   • AVPC Flow Logs
   • BAWS Config
   • CAmazon GuardDuty
   • DAWS CloudTrail
   Reveal Solution Discussion Select an answer first
5. 4application · medium

   A company is evaluating secret management solutions and requires that secrets be encrypted with customer-managed keys (CMK) and that access be auditable. Which solution meets both requirements?

   • AHashiCorp Vault with a cloud KMS auto-unseal and audit log device.
   • BAzure Key Vault with a service-managed key and diagnostic logs.
   • CAWS Secrets Manager with AWS-managed keys and CloudTrail.
   • DKubernetes Secrets with etcd encryption and no audit logging.
   Reveal Solution Discussion Select an answer first
6. 5expert · hard

   A security team needs to audit who accessed a specific secret in AWS Secrets Manager over the past 90 days. They have CloudTrail enabled. What is the most efficient way to retrieve this information?

   • AQuery CloudTrail logs in S3 using Athena for 'GetSecretValue' events.
   • BUse CloudTrail Insights to detect unusual access patterns.
   • CUse the AWS Secrets Manager console to view access history.
   • DEnable AWS Config and use its resource history.
   Reveal Solution Discussion Select an answer first