A company uses HashiCorp Vault to store database credentials for multiple applications. They need to ensure that secrets are encrypted at rest and that applications retrieve them over a secure channel. What should they configure?

Use Vault's transit engine to encrypt secrets before storing them in a database.

Store secrets in Vault's storage backend and rely on the backend's default encryption.

Enable Vault's auto-unseal with a cloud KMS key and configure applications to connect to Vault using TLS.

Disable TLS on the Vault server to reduce latency and rely on network segmentation.

A large enterprise uses a centralized secrets manager. The security team wants to allow a specific application to read a secret, but only from a specific network subnet. They also want to log all access attempts. The secrets manager supports IAM policies and audit logging. What is the BEST way to implement this?

Create an IAM policy that grants the application's service account read access to the secret, and add a condition that restricts access to the specific subnet. Enable audit logging.

Disable audit logging to improve performance and rely on the network restriction.

Grant the application's service account full access to all secrets and rely on the network firewall to restrict access.

Create a new secret for each subnet and grant the application access to all of them.

What is the purpose of versioning in a secrets management system?

To allow multiple users to set the same secret simultaneously

To permanently delete old versions immediately after rotation

To keep a history of secret values so that applications can roll back if needed

To encrypt each version with a different algorithm

A company uses a secrets manager that stores secrets in a database. They want to ensure that the secrets are encrypted at rest and that the encryption keys are managed by their own hardware security module (HSM). What should they configure?

Encrypt the secrets manually before storing them in the secrets manager using a key stored in the application.

Use a separate encryption service to encrypt the secrets and store the encrypted values in the secrets manager.

Rely on the secrets manager's default encryption and store the encryption key in the same database.

Use the secrets manager's integration with a cloud HSM to wrap the master key, and enable encryption at rest for the secrets database.

What is the first step you should take when you suspect a secret has been compromised?

Ignore it if the secret is not used frequently

Revoke the compromised secret immediately

Delete the application that used the secret

GIAC Cloud Security Essentials

Domain 3Objective 2

Secrets Management GCLD Practice Questions (Page 3)

Part of the Identity, Access, and Secrets domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 11–15

11application · medium
A company uses HashiCorp Vault to store database credentials for multiple applications. They need to ensure that secrets are encrypted at rest and that applications retrieve them over a secure channel. What should they configure?
Select an answer first
12expert · hard
A large enterprise uses a centralized secrets manager. The security team wants to allow a specific application to read a secret, but only from a specific network subnet. They also want to log all access attempts. The secrets manager supports IAM policies and audit logging. What is the BEST way to implement this?
Select an answer first
13foundation · easy
What is the purpose of versioning in a secrets management system?
Select an answer first
14application · medium
A company uses a secrets manager that stores secrets in a database. They want to ensure that the secrets are encrypted at rest and that the encryption keys are managed by their own hardware security module (HSM). What should they configure?
Select an answer first
15foundation · easy
What is the first step you should take when you suspect a secret has been compromised?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.