Secrets Management GCLD Practice Questions (Page 1)

Questions 1–5

1. 1foundation · easy

   Which of the following is a standard method to protect secrets in transit between an application and a secrets management service?

   • AUsing TLS/HTTPS for all API calls
   • BEncoding secrets in base64
   • CUsing UDP for secret retrieval
   • DStoring secrets in plaintext in configuration files
   Reveal Solution Discussion Select an answer first
2. 2expert · hard

   A company suspects that a database password stored in a secrets manager has been compromised. The password is used by multiple applications, some of which cache the password for long periods. The security team needs to rotate the password and ensure that all applications eventually use the new password without manual intervention. What is the best approach?

   • AUpdate the password in the database directly and then update the secrets manager with the new value.
   • BDisable the compromised password in the database and create a new password in the secrets manager, then wait for applications to fail and reconnect.
   • CRotate the password and rely on the applications' automatic refresh mechanisms to pick up the new version.
   • DRotate the password in the secrets manager and then restart all applications that cache the password.
   Reveal Solution Discussion Select an answer first
4. 3expert · hard

   A company is decommissioning a legacy application that uses a shared service account to access a secrets manager. The security team wants to ensure that the service account cannot be used after the application is retired. What is the BEST way to accomplish this?

   • ADelete the service account and leave the secrets unchanged.
   • BRemove the service account from the secrets manager's access policy but do not rotate the secrets.
   • CChange the service account's password and keep the secrets the same.
   • DDisable the service account and rotate all secrets that the service account had access to.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is a primary benefit of using a centralized secrets management service instead of storing secrets in application configuration files?

   • AIt eliminates the need for encryption of secrets at rest
   • BIt provides a single point of control for access policies and auditing of secret usage
   • CIt automatically makes secrets available to anyone in the organization
   • DIt stores secrets in plaintext for easier access
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A security team needs to detect when a service account is retrieving secrets from Azure Key Vault at unusual times or from unexpected IP addresses. They also want to be alerted if a secret is deleted. What should they enable?

   • AExport Key Vault logs to a storage account and manually review them every week.
   • BEnable diagnostic settings for Key Vault to send audit logs to Log Analytics, and create Azure Monitor alerts for secret get and delete operations.
   • CUse Azure Policy to deny all secret access from non-corporate IP ranges and rely on the policy logs for auditing.
   • DEnable Azure Security Center's just-in-time access for Key Vault and review the activity log monthly.
   Reveal Solution Discussion Select an answer first