Key Management Architecture GCAD Practice Questions (Page 1)

Questions 1–5

1. 1expert · medium · select all that apply

   A company needs to securely exchange encryption keys with a partner's cloud environment. The partner uses a different cloud provider. The company must ensure that the key exchange is authenticated and that the keys are protected during transit. Which of the following methods should the company consider? (Select all that apply.)

   • AUse a Diffie-Hellman key exchange over a plain HTTP connection.
   • BUse a symmetric key that is hardcoded in the application.
   • CUse mutual TLS (mTLS) with certificates from a trusted CA.
   • DUse the partner's public certificate to encrypt the key and send it over a TLS connection.
   • EUse a pre-shared key (PSK) that is exchanged via a secure file transfer service.
   Check answers Discussion Select an answer first
2. 2foundation · easy

   Which statement best describes a core principle of cryptographic key management?

   • AKeys must be protected throughout their entire lifecycle, from generation through destruction.
   • BKey management is only necessary for symmetric keys, not asymmetric keys.
   • CThe primary goal of key management is to minimize the number of keys in use, regardless of algorithm strength.
   • DKeys should be stored in the same location as the data they protect to simplify access.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A retail company is required by PCI DSS to rotate encryption keys annually and to audit all access to key material. The company uses a cloud KMS. The security team needs to automate the rotation process and ensure that the audit logs are tamper-evident. Which configuration should the team implement?

   • AUse a single key without rotation and enable logging only for failed access attempts.
   • BManually rotate keys each year and store audit logs in the KMS's default log bucket.
   • CEnable automatic key rotation in the KMS and export audit logs to an immutable storage bucket.
   • DDisable automatic rotation and rely on the cloud provider's internal rotation.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the primary role of digital certificates in key distribution?

   • ATo provide a backup copy of the public key in case the original is lost
   • BTo bind a public key to an identity, enabling trust in the key's owner
   • CTo replace the need for asymmetric encryption by providing a shared secret
   • DTo encrypt the private key so it can be safely transmitted over the network
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A financial services company uses a cloud key management service to encrypt customer data. The security team has scheduled a key rotation for next week. The compliance team requires that data encrypted with the old key remain decryptable for at least seven years, and that the company can prove which key version was used to encrypt each data object. What should the security team do to meet these requirements?

   • AKeep the old key active and use it for both encryption and decryption.
   • BDelete the old key immediately after rotation to prevent unauthorized use.
   • CDisable the old key but retain it in a 'retired' state, and record the key version used for each data object.
   • DRe-encrypt all data with the new key and then delete the old key.
   Reveal Solution Discussion Select an answer first