Key Management Architecture GCAD Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What is the primary purpose of auditing key usage in a key management system?

   • ATo reduce the number of keys required for the organization
   • BTo detect unauthorized access or use of keys and to demonstrate compliance with regulations
   • CTo automatically rotate keys when they are used too often
   • DTo speed up the encryption and decryption processes
   Reveal Solution Discussion Select an answer first
2. 22foundation · easy

   In a cloud environment, what does 'customer-managed key' typically mean?

   • AThe customer is responsible for encrypting all data before sending it to the cloud
   • BThe cloud provider generates and manages the key on behalf of the customer
   • CThe customer must store the key on-premises and cannot use cloud key services
   • DThe customer creates and controls the key, and the cloud provider uses it to encrypt the customer's data
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is the recommended method for destroying a cryptographic key that is no longer needed?

   • ARenaming the key file and moving it to a backup folder
   • BCryptographic erasure, which involves overwriting or securely deleting all copies of the key
   • CEncrypting the key with a new key and storing it in the vault
   • DChanging the key's permissions to read-only
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   What is the primary purpose of a hardware security module (HSM) in key management?

   • ATo replace the need for encryption algorithms by providing a one-time pad for every transaction
   • BTo provide a tamper-resistant environment for generating, storing, and using cryptographic keys
   • CTo store keys in a software-based vault that can be accessed by any application
   • DTo accelerate the encryption of large data volumes by caching keys in memory
   Reveal Solution Discussion Select an answer first
6. 25expert · medium

   A company is designing a key lifecycle process for a new cloud application. The security team must ensure that keys are generated securely, distributed only to authorized services, rotated regularly, and destroyed when no longer needed. The compliance team requires a complete audit trail of all key operations. Which process should the company implement?

   • AUse a single key for all services and rotate it only when a breach occurs.
   • BGenerate keys in the application code, distribute via configuration files, rotate manually, and delete keys when the application is decommissioned.
   • CUse a cloud KMS to generate and store keys, grant access via IAM roles, enable automatic rotation, and log all key operations.
   • DUse a third-party key management appliance on-premises and sync keys to the cloud.
   Reveal Solution Discussion Select an answer first