Key Management Architecture GCAD Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A multinational corporation uses a cloud provider's key management service to store keys for encrypting data in multiple regions. The security team needs to ensure that keys are protected at rest and that access to keys is logged for compliance. The company also wants to minimize the risk of a single region's compromise affecting all keys. Which configuration should the security team implement?

   • AUse a single global key vault with customer-managed keys and disable logging to reduce overhead.
   • BStore keys on-premises and use the cloud provider's key service only for encryption operations.
   • CUse separate key vaults in each region, each backed by an HSM, and enable access logging.
   • DStore all keys in a single regional key vault and enable access logging.
   Reveal Solution Discussion Select an answer first
2. 12foundation · easy

   Why is it important to protect cryptographic keys from unauthorized access?

   • ATo reduce the size of the key so it is easier to remember
   • BTo allow multiple users to share the same key without conflict
   • CTo prevent attackers from reading encrypted data without the key
   • DTo ensure that encryption algorithms run faster
   Reveal Solution Discussion Select an answer first
4. 13foundation · easy

   Which of the following lists the stages of a cryptographic key's lifecycle in the correct order?

   • AStorage, generation, distribution, rotation, destruction, retirement
   • BDistribution, generation, storage, retirement, rotation, destruction
   • CGeneration, distribution, storage, rotation, retirement, destruction
   • DGeneration, storage, distribution, destruction, rotation, retirement
   Reveal Solution Discussion Select an answer first
5. 14application · medium

   A government agency is decommissioning an old system that used a custom encryption key to protect archived records. The agency must ensure that the key cannot be used to decrypt the archived data after decommissioning, but the data must be retained for legal purposes. Which action should the agency take?

   • ADelete the key immediately and rely on backups of the data.
   • BRe-encrypt the archived data with a new key and then destroy the old key.
   • CArchive the old key in a public repository for transparency.
   • DKeep the old key in a secure vault but restrict access to it.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which practice helps ensure that key management practices meet compliance requirements?

   • ADeleting audit logs after a short retention period to reduce storage costs
   • BStoring all keys in a single location for easier management
   • CRegularly reviewing and documenting key management policies and procedures
   • DUsing the same key for all encryption needs to reduce complexity
   Reveal Solution Discussion Select an answer first