Securing Credentials and Data in the Cloud GCIH Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A development team is building a serverless application that needs to access a cloud database. They currently store the database password in the application's environment variables. The security team wants to eliminate hardcoded secrets and enforce automatic rotation. Which approach best meets these requirements?

   • AUse a long-lived database user with a complex password and change it manually every six months.
   • BUse a cloud secret management service to store the password and retrieve it at runtime via the SDK.
   • CEncrypt the environment variable with a cloud KMS key and decrypt it in the application code.
   • DStore the password in a private Git repository and clone it during deployment.
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company has a policy to rotate all cloud access keys every 60 days. A security audit reveals that a service account key has not been rotated in 120 days. The key is used by a critical application that cannot tolerate downtime. What is the most appropriate action to remediate the key rotation issue?

   • ACreate a new key, update the application to use the new key, verify the application works, and then delete the old key.
   • BExtend the rotation policy to 120 days and document the exception for this key.
   • CRotate the key immediately, even if it causes a brief downtime for the application.
   • DDisable the old key and create a new key, then update the application to use the new key.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   An organization is migrating to a cloud identity provider and wants to enforce MFA for all human users. However, some legacy applications use service accounts with static passwords. The security team is concerned about credential theft. Which combination of actions provides the strongest protection for both user and service accounts?

   • ARequire MFA only for administrators and keep service account passwords unchanged.
   • BEnable MFA for all human users and replace static service account passwords with short-lived tokens or workload identity federation.
   • CUse a conditional access policy to require MFA only when users log in from outside the corporate network.
   • DImplement MFA for service accounts by adding a virtual MFA device to each account.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   Which practice is recommended for securely storing cloud credentials used by an application?

   • AStoring them in a secret management service such as AWS Secrets Manager or Azure Key Vault
   • BPlacing them in a configuration file that is committed to a public repository
   • CSharing them with team members via email for convenience
   • DEmbedding the credentials in the application source code for easy access
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is a key difference between a service account and a regular user account in a cloud environment?

   • AService accounts are always more privileged than user accounts
   • BService accounts cannot be assigned IAM policies
   • CService accounts are only used for human users who need temporary access
   • DService accounts are used for automated applications and have no interactive login by default
   Reveal Solution Discussion Select an answer first