Secret Management Tools ECDE Practice Questions (Page 8)

Questions 36–40

1. 36expert · hard

   A DevSecOps team is designing a CI/CD pipeline for a regulated application. The pipeline must retrieve secrets from HashiCorp Vault, but the Vault server is only reachable from a private network. The build agents run in a public cloud and cannot access the private network directly. The team needs a solution that minimizes the risk of secret exposure and maintains auditability. Which approach should they take?

   • ASet up a Vault replication cluster in the public cloud and have build agents authenticate using a periodic token.
   • BUse Vault Agent to authenticate with a short-lived token and fetch secrets via a proxy that is accessible from the build agents.
   • CUse a self-hosted build agent that runs inside the private network and fetches secrets directly from Vault.
   • DCopy the secrets to a public cloud secret store and have the build agents fetch from there.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   Which of the following secret management tools is a cloud-native service that integrates natively with AWS IAM and can automatically rotate secrets for supported AWS services?

   • AAWS Secrets Manager
   • BHashiCorp Vault
   • CAzure Key Vault
   • DCyberArk Conjur
   Reveal Solution Discussion Select an answer first
4. 38expert · hard

   An organization uses AWS Secrets Manager to store a database credential. The credential is rotated automatically every 30 days. However, after a recent rotation, several applications failed to connect to the database. The team suspects that the applications are caching the old credential. What should the team do to ensure applications use the new credential after rotation?

   • ASet the secret's version to 'AWSCURRENT' and rely on the applications to detect the change.
   • BUpdate the applications to fetch the secret from Secrets Manager at runtime instead of caching it.
   • CUse the Secrets Manager rotation Lambda to also update the applications' configuration files.
   • DDisable automatic rotation and manually update the applications.
   Reveal Solution Discussion Select an answer first
5. 39foundation · easy

   In the lifecycle of a secret, what is the final stage after a secret is no longer needed or has been compromised?

   • ARotation
   • BStorage
   • CRevocation
   • DCreation
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A development team frequently commits code that contains hardcoded API keys. They want to automatically block any commit that contains a known secret pattern before it reaches the central repository. Which tool should they integrate into their developer workflow?

   • AA server-side hook on the Git server that rejects the push.
   • BA scheduled scan of the repository that runs nightly.
   • CA CI pipeline job that scans the code after the commit is pushed.
   • DA pre-commit hook using a tool like git-secrets or trufflehog.
   Reveal Solution Discussion Select an answer first