Key Management Architecture GCAD Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A startup is building a cloud-native application and wants to use envelope encryption to protect sensitive data. The startup's CTO wants to minimize the risk of a data breach if the application server is compromised. The team also needs to comply with an audit requirement that all key usage be logged. Which approach should the team adopt?

   • AGenerate a DEK locally, encrypt it with a customer-managed key in the cloud KMS, and store the encrypted DEK with the data.
   • BStore the data encryption key (DEK) in the application's configuration file and use a cloud KMS to encrypt the DEK.
   • CUse a single master key for all data and store it in the application's memory.
   • DUse a cloud KMS to generate and store the DEK, and have the application call the KMS for every encryption operation.
   Reveal Solution Discussion Select an answer first
2. 27foundation · easy

   In the shared responsibility model for cloud key management, which task is typically the customer's responsibility?

   • AEnsuring physical security of the data center where keys are stored
   • BManaging access policies that control who can use the keys
   • CPatching the underlying hardware of the cloud key management service
   • DProviding the cryptographic algorithms used by the key service
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   What is the primary security control required during the key generation stage of the lifecycle?

   • AEncrypting the key with a master key before it is used
   • BUsing a cryptographically secure random number generator
   • CDistributing the key to all authorized users immediately
   • DStoring the key in a hardware security module
   Reveal Solution Discussion Select an answer first
5. 29expert · medium · select all that apply

   A company must comply with a regulation that requires all key management operations to be audited and that keys be rotated at least annually. The company uses a cloud KMS. Which of the following measures should the company implement to meet these requirements? (Select all that apply.)

   • AStore audit logs only in the KMS's default log bucket without additional protection.
   • BDisable automatic rotation and rely on manual rotation.
   • CConfigure alerts for any key access or management operations.
   • DEnable automatic key rotation with a 365-day period.
   • EExport audit logs to an immutable storage bucket.
   Check answers Discussion Select an answer first
6. 30application · medium

   A global company needs to securely exchange encryption keys with a business partner in a different country. The partner's environment uses a different cloud provider. The company wants to ensure that the key exchange is authenticated and that the keys are not exposed during transit. Which approach should the company use?

   • ASend the key via a courier on a USB drive.
   • BUse a symmetric key exchange protocol like Diffie-Hellman over a TLS connection.
   • CUse the partner's public certificate to encrypt the key and send it over a secure channel.
   • DUse a shared secret that was exchanged via a phone call.
   Reveal Solution Discussion Select an answer first