Secret Management Tools ECDE Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A team is using a monorepo with multiple microservices. They want to ensure that secrets are not committed to the repo and that each service can access only its own secrets. Which approach is best?

   • AUse a different secret management tool for each microservice.
   • BUse a single secret management tool and create separate paths or namespaces for each service.
   • CStore all secrets in a single file in the repo and use environment variables to select the right one.
   • DUse a .env file that is ignored by Git and shared among all services.
   Reveal Solution Discussion Select an answer first
2. 42application · medium

   A developer wants to store a database password in a Kubernetes Secret so that a pod can use it as an environment variable. What is a critical security consideration the team should address?

   • AKubernetes Secrets should be stored in a ConfigMap to avoid the risk of exposure.
   • BKubernetes Secrets are automatically encrypted in transit and at rest, so no additional configuration is needed.
   • CKubernetes Secrets are stored in etcd, so encryption at rest must be enabled for the etcd data.
   • DKubernetes Secrets are only accessible by the pod that references them, so no access control is needed.
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   Which of the following is a common technique used by secret scanning tools to identify potential secrets in code?

   • ACompiling the code to check for syntax errors
   • BPattern matching for known secret formats, such as AWS access key IDs
   • CComparing the code against a list of open-source licenses
   • DRunning the code in a sandbox to observe behavior
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   In a CI/CD pipeline, what is the recommended way to provide secrets to a build job?

   • AWrite secrets to a file in the repository and read them during the build
   • BEmbed the secrets directly in the pipeline configuration file
   • CStore secrets in a secret management tool and inject them as environment variables at runtime
   • DPass secrets as command-line arguments in the build script
   Reveal Solution Discussion Select an answer first