Secret Management Tools ECDE Practice Questions (Page 3)

Questions 11–15

1. 11foundation · easy

   In a DevSecOps context, which of the following best describes the primary purpose of secret management?

   • ATo securely store, control access to, and manage the lifecycle of sensitive credentials
   • BTo replace all authentication mechanisms with API keys
   • CTo encrypt all data stored in a cloud environment
   • DTo monitor network traffic for unauthorized access attempts
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company uses HashiCorp Vault to manage secrets. Their CI/CD pipeline runs on Jenkins and needs to fetch a database credential at deployment time. The security team requires that the credential is never written to the build log and that access is limited to the specific pipeline job. Which configuration should be used?

   • ACreate a Vault policy that grants read access to the specific path only to the Jenkins service account, and use the Vault Agent with a template to inject the secret into a file with restricted permissions.
   • BUse the Vault API from the pipeline to fetch the secret and pass it as an environment variable to the deployment job.
   • CStore the database credential in Jenkins credentials store and reference it in the pipeline.
   • DUse the Vault Agent to render the secret into a temporary file that the deployment script reads, then delete the file.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   A startup is building a multi-cloud application that runs on both AWS and Azure. They need a central secret management solution that supports dynamic secrets, has a unified audit log, and can enforce fine-grained access policies across both clouds. Which tool should they choose?

   • AAWS Secrets Manager
   • BHashiCorp Vault
   • CKubernetes Secrets
   • DAzure Key Vault
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A team uses Azure Key Vault to store a client secret for an application. The secret is currently set to never expire. The security team wants to enforce a maximum lifetime of 90 days and ensure that the application automatically receives the new secret after rotation. What should the team do?

   • ACreate a new version of the secret with a 90-day expiration and configure the application to reference the latest version.
   • BSet the expiration date on the secret to 90 days and manually update the application with the new secret.
   • CUse a Key Vault access policy to automatically rotate the secret every 90 days.
   • DDisable the secret after 90 days and create a new one manually.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A security auditor requires that every access to a production secret be logged with the user, timestamp, and action. The team uses HashiCorp Vault. What should they enable to meet this requirement?

   • AUse Vault's built-in syslog output and rely on local log rotation.
   • BEnable Vault's telemetry and monitor metrics like secret read counts.
   • CEnable Vault's replication and use the secondary cluster's logs.
   • DEnable Vault's audit log device and send logs to a centralized SIEM.
   Reveal Solution Discussion Select an answer first