Secret Management Tools ECDE Practice Questions (Page 4)

Questions 16–20

1. 16application · hard

   An organization uses HashiCorp Vault to manage database credentials for a legacy application that only reads the database password from a config file at startup. The security team wants to enforce automatic rotation without requiring the application to be restarted. What should the team implement?

   • AUse Vault Agent to write the new password to the config file and then restart the application service.
   • BManually rotate the password in Vault and update the config file during a maintenance window.
   • CUse Vault's database secrets engine with a periodic rotation policy and configure the application to reload the config file periodically.
   • DSet a short TTL on the database lease and require the application to re-authenticate to Vault on each new connection.
   Reveal Solution Discussion Select an answer first
2. 17foundation · easy

   Which of the following is a key feature of HashiCorp Vault that distinguishes it from many cloud-native secret management services?

   • AIt cannot integrate with Kubernetes or CI/CD pipelines
   • BIt provides dynamic secrets that are generated on demand and have short-lived leases
   • CIt is exclusively available as a managed service on AWS
   • DIt only supports storage of static key-value pairs
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company stores secrets in Azure Key Vault. They want to ensure that only a specific application (using a managed identity) can read a particular secret, and that all read operations are logged. What should they configure?

   • ACreate an access policy that grants the managed identity 'Get' permission on the secret, and enable diagnostic settings for the vault.
   • BGrant the application 'Contributor' role on the entire subscription.
   • CStore the secret in a storage account and use a container SAS token.
   • DUse a shared access signature (SAS) to allow the application to access the secret.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company uses AWS Secrets Manager to rotate database credentials for a legacy application that does not support dynamic credentials. The application reads the password from a config file at startup. The team wants to automate rotation without causing downtime. What is the best approach?

   • AUse Secrets Manager's built-in rotation with a custom Lambda that updates the database and the config file, and have the application reload the config file periodically.
   • BUse a script that runs before the application starts to fetch the latest secret from Secrets Manager.
   • CUse a Lambda function to rotate the secret and update the config file, then restart the application.
   • DManually rotate the password and update the config file during a maintenance window.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A team uses GitLab CI/CD and wants to inject a database connection string from HashiCorp Vault into their deployment job. The job runs in a Docker container. They need to ensure the secret is available only to that job and is not visible in the job logs. Which approach should they use?

   • AStore the connection string in the GitLab CI/CD variables and mark it as protected.
   • BUse GitLab's 'vault' keyword in the job definition to fetch the secret and expose it as a masked environment variable.
   • CUse a custom script that calls the Vault API and writes the secret to a shared volume.
   • DUse the Vault CLI inside the job to fetch the secret and echo it into a file.
   Reveal Solution Discussion Select an answer first