Key Management Architecture GCAD Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Which protocol is commonly used to securely exchange symmetric keys over an untrusted network?

   • ADiffie-Hellman key exchange
   • BPretty Good Privacy (PGP) key revocation
   • CSecure Sockets Layer (SSL) certificate signing
   • DAdvanced Encryption Standard (AES) key wrapping
   Reveal Solution Discussion Select an answer first
2. 17expert · medium

   A financial institution is required to store encryption keys in a FIPS 140-2 Level 3 validated HSM. The institution uses a cloud provider that offers both a managed HSM service and a cloud KMS with HSM-backed keys. The institution also needs to perform cryptographic operations at high throughput and must maintain low latency. Which option should the institution choose?

   • AUse a software-based key vault and rely on the provider's compliance certifications.
   • BUse the cloud KMS with HSM-backed keys for all operations.
   • CUse the cloud KMS for key storage and perform encryption in the application using a local key.
   • DUse the managed HSM service and integrate it directly with the application.
   Reveal Solution Discussion Select an answer first
4. 18expert · medium · select all that apply

   A company is designing a key lifecycle management process for a cloud application. The process must ensure that keys are generated securely, distributed only to authorized services, rotated regularly, and destroyed when no longer needed. Which of the following practices should the company include? (Select all that apply.)

   • AEnable automatic key rotation and retain old key versions for decryption.
   • BLog all key management operations for audit purposes.
   • CGenerate keys using a cloud KMS or HSM to ensure randomness and security.
   • DDestroy keys immediately after rotation to prevent unauthorized use.
   • EDistribute keys via encrypted configuration files that are stored in a source code repository.
   Check answers Discussion Select an answer first
5. 19foundation · easy

   Why is periodic key rotation considered a security best practice?

   • ATo ensure that the key remains compatible with older encryption algorithms
   • BTo allow multiple users to use the same key without conflict
   • CTo reduce the size of the key so that it is easier to manage
   • DTo limit the amount of data encrypted with a single key, reducing the impact of a key compromise
   Reveal Solution Discussion Select an answer first
6. 20expert · medium · select all that apply

   A healthcare organization is moving to a public cloud and must comply with HIPAA, which requires that encryption keys be protected and that access to keys be logged. The organization wants to use customer-managed keys. Which of the following controls should the organization implement? (Select all that apply.)

   • AImplement strict IAM policies to limit who can access and manage keys.
   • BEnable detailed audit logging for all key access and management operations.
   • CDisable logging to reduce storage costs.
   • DStore keys in a cloud HSM that is FIPS 140-2 validated.
   • EUse the cloud provider's default service-managed keys to reduce management overhead.
   Check answers Discussion Select an answer first