Secret Management Tools ECDE Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A company uses a mix of AWS and on-premises servers. They need a secret management solution that can store secrets, provide dynamic database credentials, and integrate with both AWS and on-premises workloads. Which tool is best suited for this hybrid environment?

   • AHashiCorp Vault, because it is cloud-agnostic and supports dynamic secrets for databases.
   • BAzure Key Vault, because it supports both cloud and on-premises with Azure Arc.
   • CA custom solution using encrypted files and a shared network drive.
   • DAWS Secrets Manager, because it is fully managed and supports rotation.
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A GitLab CI/CD pipeline needs to access a secret stored in HashiCorp Vault. The team wants to avoid storing the Vault token in the pipeline configuration. What is the recommended approach?

   • AHardcode the Vault token in the .gitlab-ci.yml file.
   • BStore the Vault token as a CI/CD variable in GitLab.
   • CUse GitLab's built-in Vault integration with JWT authentication.
   • DUse a service account with a static token and store it in a file.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   During a code review, a developer accidentally committed an AWS access key to a public GitHub repository. The key was exposed for 48 hours before being noticed. What is the FIRST action the team should take?

   • AUse git filter-branch to rewrite history and then force-push the cleaned repository.
   • BRotate the AWS access key immediately and then remove it from the repository history.
   • CEnable AWS CloudTrail to audit who used the key before rotating it.
   • DDelete the repository and recreate it to remove the key from history.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A DevSecOps team is deploying a microservices application to AWS. They need to store database credentials and API keys, automatically rotate them, and inject them into containers at runtime without baking them into images. Which solution best meets these requirements?

   • AEncrypt secrets with KMS and store them in a private S3 bucket, then download them during the build stage.
   • BStore secrets in environment variables in the container definition and update them manually.
   • CUse AWS Secrets Manager and retrieve secrets via the AWS SDK or Secrets Manager sidecar at container startup.
   • DUse HashiCorp Vault with a Kubernetes sidecar to inject secrets, but disable dynamic secrets to simplify management.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A developer is about to commit code that contains a hardcoded database password. Which of the following is the BEST way to prevent this from happening?

   • AStore the password in a .env file that is not committed.
   • BRely on code review to catch the password.
   • CUse a pre-commit hook that scans for common password patterns.
   • DUse a secret scanning tool in the CI pipeline that fails the build on detection.
   Reveal Solution Discussion Select an answer first