Securing Credentials and Data in the Cloud GCIH Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A cloud environment has a service account that is used by multiple applications. The service account currently has a policy that grants full access to all storage buckets and all compute instances. The security team wants to reduce the risk of credential abuse but cannot break the applications. Which approach best balances security and operational continuity?

   • AKeep the current service account but rotate its key every 30 days.
   • BCreate separate service accounts for each application with scoped IAM policies and migrate applications one at a time.
   • CAttach a deny policy to the service account that blocks access to sensitive buckets.
   • DUse a single access key for all applications but store it in a secret management service.
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Why is regular rotation of cloud credentials important?

   • AIt makes credentials easier to remember
   • BIt eliminates the need for MFA
   • CIt ensures that credentials never expire
   • DIt reduces the window of opportunity for an attacker to use compromised credentials
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the first step in responding to a suspected cloud credential compromise?

   • ARevoking the compromised credential to stop unauthorized access
   • BDeleting all cloud resources associated with the credential
   • CWaiting to see if the credential is used again
   • DInforming all users of the compromise before taking action
   Reveal Solution Discussion Select an answer first
5. 34foundation · easy

   What is the purpose of monitoring credential usage in a cloud environment?

   • ATo automatically rotate credentials on a schedule
   • BTo prevent users from accessing the cloud console
   • CTo identify unusual or unauthorized use of credentials
   • DTo increase the number of credentials available
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A development team wants to store database credentials in a cloud secret management service. The security team requires that the credentials be automatically rotated and that access to the secrets be audited. The team also wants to minimize the risk of secrets appearing in logs. Which configuration is most appropriate?

   • AUse a KMS key to encrypt the secret and store the encrypted value in a configuration file.
   • BStore the secret in a secret management service but disable logging to reduce exposure.
   • CStore the secret in a versioned secret management service and manually rotate it every 90 days.
   • DEnable automatic rotation in the secret management service and configure audit logging for secret access.
   Reveal Solution Discussion Select an answer first