Key Management Architecture GCAD Practice Questions (Page 2)

Questions 6–10

1. 6application · medium

   A healthcare organization uses a cloud provider's managed key service for encrypting patient data. The compliance team requires that the organization retain the ability to cryptographically erase data if a data breach occurs, and also requires that key usage be auditable. The organization wants to minimize the administrative burden of key management. Which approach best meets these requirements?

   • AUse customer-managed keys stored in the provider's key vault, with the organization retaining control over key deletion and enabling audit logging on key operations.
   • BGenerate keys on-premises and import them into the provider's key vault, but disable audit logging to reduce overhead.
   • CUse a third-party key management service that stores keys off-cloud and provides no integration with the provider's audit logs.
   • DUse the cloud provider's default service-managed keys and rely on the provider's audit logs.
   Reveal Solution Discussion Select an answer first
2. 7expert · medium · select all that apply

   A government agency requires that encryption keys be stored in a dedicated HSM that is under the agency's control. The agency also needs to ensure that keys are protected at rest and that access is logged. Which of the following controls should the agency implement? (Select all that apply.)

   • AUse a single-tenant HSM service that is FIPS 140-2 Level 3 validated.
   • BStore keys in a software vault with encryption at rest.
   • CUse a multi-tenant HSM service to reduce costs.
   • DEnable detailed audit logging for all key access and management operations.
   • EEnable key export to allow backup and disaster recovery.
   Check answers Discussion Select an answer first
4. 8expert · hard

   A company is using a cloud provider's key management service with customer-managed keys. The compliance team requires that all key access be logged and that the logs be retained for at least seven years. The company is concerned about the cost of log storage. What is the best approach to meet the compliance requirement while managing costs?

   • AUse the cloud provider's default audit logging and do not export logs, relying on the provider to retain them.
   • BDisable audit logging to avoid the cost of log storage.
   • CEnable audit logging for all key operations and export the logs to a low-cost storage tier with a retention policy of seven years.
   • DEnable audit logging but only retain logs for one year to reduce costs.
   Reveal Solution Discussion Select an answer first
5. 9foundation · easy

   Which technique is commonly used to protect keys at rest in a software-based key vault?

   • AStoring keys in plaintext but with strict file permissions
   • BUsing a hash of the key to verify integrity instead of storing the key itself
   • CSplitting the key into parts and storing each part on the same server
   • DEncrypting the keys with a master key that is stored separately
   Reveal Solution Discussion Select an answer first
6. 10expert · medium

   A company is required to rotate encryption keys every 30 days for a high-security application. The application uses a cloud KMS. The security team must ensure that the rotation does not cause downtime and that all data remains accessible. The team also needs to prove to auditors that rotation occurred on schedule. Which approach should the team take?

   • AEnable automatic rotation with a 30-day period and use key versioning to maintain access to old data.
   • BManually rotate keys every 30 days and update all applications simultaneously.
   • CUse a single key and rotate it only when a compromise is suspected.
   • DDisable automatic rotation and use a third-party tool to rotate keys.
   Reveal Solution Discussion Select an answer first