Securing Credentials and Data in the Cloud GCIH Practice Questions (Page 6)

Questions 26–30

1. 26expert · hard

   An organization has a policy to rotate cloud access keys every 60 days. A critical application uses an access key that is embedded in a configuration file and cannot be updated without a maintenance window. The key is 75 days old. The security team is concerned about the risk of compromise. What is the best approach to manage this risk?

   • AExtend the rotation policy to 90 days to avoid the maintenance window.
   • BRotate the key during the next maintenance window and move the key to a secret management service.
   • CCreate a new key, update the application immediately, and delete the old key.
   • DDisable the key immediately and wait for the application to fail before updating it.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A security analyst notices unusual activity in the cloud environment: an access key that is normally used only during business hours is being used at 3:00 AM from an unfamiliar IP address. The analyst suspects the key has been compromised. What is the most immediate action the analyst should take?

   • AChange the permissions of the access key to read-only and then investigate the activity.
   • BCreate a new access key and update the application to use the new key, then investigate the activity.
   • CDisable the access key immediately and then investigate the activity in the logs.
   • DInvestigate the activity in the logs first and then disable the access key if the activity is confirmed as malicious.
   Reveal Solution Discussion Select an answer first
4. 28foundation · easy

   Why is it important to avoid hardcoding cloud credentials in application code?

   • AHardcoded credentials are only accessible to the application owner
   • BHardcoded credentials are automatically rotated by the cloud provider
   • CHardcoded credentials are difficult to rotate and can be exposed in source code repositories
   • DHardcoded credentials are more secure because they are not transmitted over the network
   Reveal Solution Discussion Select an answer first
5. 29foundation · easy

   Why is it recommended to use a cloud KMS rather than storing encryption keys in application code?

   • AKMS keys are never used for encryption
   • BKMS keys are automatically shared with all users
   • CKMS eliminates the need for encryption altogether
   • DKMS provides centralized control, rotation, and auditing of key usage
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A cloud administrator is creating an IAM policy for a new application that only needs to read from a specific storage bucket and write logs to a specific log group. The application runs on a compute instance. What is the most appropriate IAM policy design?

   • AUse the instance's default service account with no additional IAM policy.
   • BAttach a managed policy that grants read access to all storage buckets and write access to all log groups.
   • CCreate a user with programmatic access and attach a policy granting full access to all storage and logging services.
   • DGrant the instance role the minimal permissions for the specific bucket and log group.
   Reveal Solution Discussion Select an answer first