Secret Management Tools ECDE Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of an access control mechanism used by secret management tools to restrict who can retrieve a secret?

   • AEncrypting the secret with a public key
   • BUsing a checksum to verify integrity
   • CStoring the secret in a public repository
   • DUsing role-based access control (RBAC) policies
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A CI/CD pipeline builds a Docker image and pushes it to a registry. The pipeline needs to authenticate to the registry using a token stored in Azure Key Vault. What is the recommended way to inject the token into the pipeline without exposing it in logs?

   • AStore the token in a plain text file in the repository and read it during the build.
   • BHardcode the token in the pipeline YAML file and rely on the registry to reject invalid tokens.
   • CUse a pipeline secret variable that references the Key Vault secret via a Key Vault task or variable group.
   • DDownload the token from Key Vault in a pipeline step and echo it to the console for debugging.
   Reveal Solution Discussion Select an answer first
4. 33application · medium

   A CI/CD pipeline uses Jenkins to deploy to a Kubernetes cluster. The pipeline needs to authenticate to the cluster using a service account token. What is the recommended way to store and inject the token into the Jenkins pipeline?

   • AUse a Kubernetes secret and mount it as a volume in the Jenkins pod.
   • BHardcode the token in the Jenkinsfile and use it in a shell command.
   • CStore the token as a Jenkins credential and use the Kubernetes CLI plugin to authenticate.
   • DStore the token in a text file in the Jenkins workspace and read it during the build.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A developer accidentally commits a private key to a Git repository and pushes it to the remote. The key is used for SSH authentication to production servers. What should the team do FIRST?

   • AChange the repository's visibility to private.
   • BRemove the key from the repository and force-push the corrected history.
   • CRevoke the private key and generate a new one, then update the production servers.
   • DAdd a .gitignore entry to prevent future commits of the key.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security scan of a code repository found a hardcoded API key in a commit from three months ago. The key is still valid. What is the most important action to take?

   • AAdd a secret scanning tool to the CI pipeline to prevent future leaks.
   • BChange the repository from public to private.
   • CRemove the key from the repository history using git filter-branch.
   • DRevoke the API key immediately and issue a new one.
   Reveal Solution Discussion Select an answer first