Securing Credentials and Data in the Cloud GCIH Practice Questions (Page 4)

Questions 16–20

1. 16application · medium

   A security analyst discovers that a long-lived access key for a cloud service account was accidentally committed to a public code repository. The key has broad permissions across multiple projects. The organization's incident response plan requires immediate containment. What is the most effective first step to limit further exposure?

   • AEnable MFA on the service account and require a token for API calls.
   • BDelete the service account and recreate it with a new name.
   • CRestrict the key to a single IP address range and monitor for anomalies.
   • DRotate the access key immediately and update the service account's IAM policy to least privilege.
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A financial services company uses a cloud key management service (KMS) to manage encryption keys for data at rest. The compliance team requires that keys be rotated annually and that the company retain the ability to decrypt data encrypted with old keys. What is the correct approach to key rotation in the KMS?

   • AEnable automatic key rotation in the KMS, which creates new key material while keeping the old key material available for decryption.
   • BDisable the old key and create a new key, then re-encrypt all data with the new key.
   • CCreate a new key and update all applications to use the new key, but keep the old key in the KMS without any rotation schedule.
   • DCreate a new key and re-encrypt all data with the new key, then delete the old key.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard · select all that apply

   A cloud administrator discovers that a user's access key was compromised and used to access a storage bucket containing customer data. The administrator has already revoked the key. Select all that apply: Which additional steps should be part of the incident response process?

   • ADisable the user's account permanently.
   • BDelete the storage bucket to prevent further access.
   • CRotate all other access keys associated with the same user.
   • DReview the bucket's access logs to determine what data was accessed.
   • ENotify the affected customers if required by law or regulation.
   Check answers Discussion Select an answer first
5. 19application · medium

   A security engineer needs to protect encryption keys used for a cloud database. The keys must be stored separately from the data, and access to the keys must be auditable. The engineer also wants to automate key rotation. Which solution is most appropriate?

   • AUse a hardware security module (HSM) but do not enable logging.
   • BEncrypt the keys with a passphrase and store them in the same storage bucket as the data.
   • CStore the keys in a configuration file on the database server.
   • DUse a cloud KMS with automatic key rotation and enable audit logging for key usage.
   Reveal Solution Discussion Select an answer first
6. 20expert · medium

   A security engineer is designing a secret management strategy for a cloud-native application. The application needs to access a database and an external API. The engineer wants to avoid storing secrets in the application code and wants to ensure that secrets are rotated automatically. What is the most appropriate approach?

   • AUse a secret management service to store the secrets and configure the application to retrieve them at runtime, with automatic rotation enabled.
   • BStore the secrets in a configuration file that is only accessible to the application's service account.
   • CEncrypt the secrets in the application code using a hardcoded encryption key and decrypt them at runtime.
   • DStore the secrets in environment variables and rotate them manually every 90 days.
   Reveal Solution Discussion Select an answer first