Secrets Management GCLD Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   Why is auditing secret access important for compliance and security?

   • AIt speeds up secret retrieval
   • BIt automatically encrypts secrets
   • CIt allows administrators to see who accessed which secrets and when
   • DIt prevents all unauthorized access to secrets
   Reveal Solution Discussion Select an answer first
2. 17application · medium

   A development team wants to deploy a web application using a CI/CD pipeline. The application needs a database connection string. The team wants to avoid storing the connection string in the pipeline configuration file. What should they do?

   • AUse a public environment variable in the CI/CD system without marking it as secret.
   • BHardcode the connection string in the application source code and rely on repository access controls.
   • CStore the connection string as a secret in the CI/CD system's secret store and reference it in the pipeline, then inject it as an environment variable during deployment.
   • DPlace the connection string in a plain text file in the pipeline's working directory.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A company suspects that a database password stored in its secrets manager has been compromised. The password is used by several applications. What is the FIRST step in the incident response process?

   • ADisable the secrets manager to prevent further access.
   • BImmediately rotate the database password and update all applications to use the new version.
   • CConduct a full forensic analysis of all systems before rotating the password.
   • DNotify all users of the database that the password may be compromised.
   Reveal Solution Discussion Select an answer first
5. 19expert · hard

   A company uses a secrets manager to store API keys for multiple third-party services. They have a microservices architecture where each service needs access to a different set of keys. They also need to rotate keys independently per service without affecting others. What is the best way to structure the secrets and access control?

   • AUse a single secret with multiple versions and have each service use a different version.
   • BCreate a separate secret for each API key and grant each service's identity access only to the secrets it needs.
   • CCreate a shared secret for all services and rotate it on a fixed schedule.
   • DStore all API keys in a single secret and grant all services access to that secret.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A security auditor requires that all secrets stored in the cloud secrets manager be encrypted at rest and that all API calls to retrieve secrets use encrypted channels. The secrets manager already encrypts data at rest with a cloud-managed key. What additional configuration is needed to meet the auditor's requirement?

   • AEnable versioning on the secrets manager to keep historical versions.
   • BSet a short rotation period for all secrets.
   • CRestrict access to the secrets manager using IP allowlists.
   • DEnsure that all client applications use HTTPS/TLS when calling the secrets manager API.
   Reveal Solution Discussion Select an answer first