Which of the following is an example of a secret that should be managed by a dedicated secret management tool?

A database connection string containing a username and password

A public encryption key used for verifying digital signatures

The IP address of a public web server

The source code of a public open-source library

Which of the following is a common method for a CI/CD pipeline to authenticate to a secret management tool without storing long-lived credentials in the pipeline?

Using a shared secret that is identical across all pipelines

Using a username and password hardcoded in the pipeline script

Using a static API key stored in the pipeline's environment variables

Using a cloud provider's identity service, such as IAM roles or workload identity federation

When a secret is stored in a modern secret management tool, what is the typical method used to protect the secret at rest?

Hashing the secret with a one-way hash function

Encrypting the secret using strong encryption algorithms before storing it

Storing the secret in plaintext in a database with restricted network access

Encoding the secret using Base64

A company uses Azure Key Vault to store secrets for multiple applications. They want to ensure that secrets are encrypted at rest and that access is limited to specific applications. They also need to rotate secrets automatically. What should they configure?

Use a customer-managed key (CMK) for encryption and configure access policies for each application.

Enable diagnostic settings and use Azure Policy to enforce access.

Enable soft-delete and purge protection, and use access policies.

Use a system-assigned managed identity for each application and grant it access to the vault.

What is the primary purpose of auditing in a secret management system?

To track who accessed secrets and when, for security and compliance

To automatically rotate secrets on a schedule

To encrypt secrets using a stronger algorithm

To reduce the number of secrets in the system

EC-CouncilCertified DevSecOps Engineer

Domain 2Objective 4

Secret Management Tools ECDE Practice Questions (Page 6)

Part of the Plan Stage: Threat Modeling and Pre-Commit Security domain, which makes up ~19% of our current practice bank.

44questions here

9free pages

7concepts

Questions 26–30

26foundation · easy
Which of the following is an example of a secret that should be managed by a dedicated secret management tool?
Select an answer first
27foundation · easy
Which of the following is a common method for a CI/CD pipeline to authenticate to a secret management tool without storing long-lived credentials in the pipeline?
Select an answer first
28foundation · easy
When a secret is stored in a modern secret management tool, what is the typical method used to protect the secret at rest?
Select an answer first
29expert · hard
A company uses Azure Key Vault to store secrets for multiple applications. They want to ensure that secrets are encrypted at rest and that access is limited to specific applications. They also need to rotate secrets automatically. What should they configure?
Select an answer first
30foundation · easy
What is the primary purpose of auditing in a secret management system?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to ECDE

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by EC-Council. “ECDE” is a trademark of its owner, used for identification only.