Secrets Management GCLD Practice Questions (Page 2)

Questions 6–10

1. 6expert · hard

   A company discovers that a third-party service has been compromised, and the API key used to access that service was stored in their secrets manager. The API key is used by multiple applications. What is the BEST immediate response?

   • AChange the permissions on the secrets manager to deny access to the API key.
   • BInvestigate the third-party service's logs first to determine the impact before rotating the key.
   • CDisable the API key and wait for the third-party service to provide a new one.
   • DRotate the API key immediately, update all applications to use the new key, and then investigate the extent of the compromise.
   Reveal Solution Discussion Select an answer first
2. 7foundation · easy

   What is a key advantage of integrating applications with a secrets management service to retrieve secrets dynamically?

   • AIt eliminates the need for application authentication
   • BIt makes the application run faster by caching secrets in memory
   • CIt allows secrets to be rotated without redeploying or modifying the application
   • DIt ensures that secrets are never transmitted over the network
   Reveal Solution Discussion Select an answer first
4. 8application · medium

   A development team is building a microservices application on Azure. Each service needs to authenticate to a shared Azure SQL database using different credentials. The team wants to avoid storing credentials in source code or configuration files. They also need to ensure that each service can only retrieve its own credentials. What should the team implement?

   • AEmbed the connection strings in each service's application settings and restrict access to the settings using Azure role-based access control.
   • BGenerate a new connection string for each service and store them in a configuration file that is encrypted with a certificate on each virtual machine.
   • CUse a shared connection string for all services and store it in a single environment variable that is injected at deployment time.
   • DStore all credentials in Azure Key Vault and grant each service's managed identity access to the specific secrets it needs.
   Reveal Solution Discussion Select an answer first
5. 9expert · hard

   A security engineer is configuring access to a secrets manager for a new application. The application needs to read a database password, but the security team wants to ensure that if the application is compromised, the attacker cannot read other secrets or modify the password. The secrets manager supports IAM policies and audit logging. What is the BEST configuration?

   • AEmbed the database password in the application's configuration file and restrict file permissions.
   • BStore the database password in a separate secrets manager instance and grant the application access to that instance only.
   • CCreate an IAM role for the application with read-only access to the specific secret, and enable audit logging to monitor access.
   • DGrant the application's service account full access to all secrets and rely on the application's security.
   Reveal Solution Discussion Select an answer first
6. 10expert · hard

   A company uses GitLab CI/CD to deploy to Kubernetes. They need to inject database credentials into pods at runtime without storing them in the GitLab project or in Kubernetes secrets. They also want to ensure that only pods in the production namespace can access the production credentials. What is the best approach?

   • ACreate a Kubernetes secret in the production namespace and reference it in the pod spec, then restrict access to the secret using RBAC.
   • BStore the credentials as GitLab CI/CD variables and inject them into the pod using environment variables during deployment.
   • CUse an external secrets operator that syncs secrets from a cloud secrets manager to Kubernetes, and configure the operator to only sync to the production namespace.
   • DUse a sidecar container that retrieves the secret from the cloud secrets manager and writes it to a shared volume.
   Reveal Solution Discussion Select an answer first