Secrets Management GCLD Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   In the context of secrets management, what does 'rotation' of a secret refer to?

   • AReplacing an existing secret with a new one after a period of time or when compromise is suspected
   • BCopying a secret to multiple regions for high availability
   • CDeleting a secret from the secrets store permanently
   • DChanging the access control policy for a secret
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company stores API keys for a third-party payment service in AWS Secrets Manager. They want to automatically rotate the keys every 30 days and ensure that if a key is compromised, they can quickly invalidate it without affecting the current version. What should they configure?

   • AUse AWS Systems Manager Parameter Store with a secure string and set a TTL of 30 days so the parameter expires automatically.
   • BManually rotate the key every 30 days and delete the old version immediately after updating the application configuration.
   • CEnable automatic rotation with a rotation schedule of 30 days and configure the secret to keep multiple versions, then use the current version in applications.
   • DStore the API key in an encrypted file in S3 and use a Lambda function to update the file every 30 days.
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A company uses a secrets manager with automated rotation for database credentials. The rotation policy is set to rotate every 24 hours. However, some applications cache the database connection string for up to 48 hours. What problem might occur, and what is the BEST solution?

   • AApplications may fail to connect after rotation because they are using a cached old password. The solution is to update applications to fetch the secret more frequently or use a connection pool that refreshes credentials.
   • BThe secrets manager will run out of storage because of too many versions. The solution is to disable versioning.
   • CThe database will be locked out because of too many password changes. The solution is to rotate less frequently.
   • DThe secrets manager will automatically update the database password, but applications will continue to work because they use the same connection string.
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   A security operations team wants to detect when an application service account unexpectedly reads a large number of secrets in a short time. What should they enable in the secrets manager?

   • AAutomated rotation with a short interval.
   • BVersioning to keep multiple secret versions.
   • CAudit logging that records all secret access requests, including the caller identity and timestamp.
   • DEncryption of secrets at rest with a customer-managed key.
   Reveal Solution Discussion Select an answer first
6. 25application · medium

   A company uses Google Cloud Secret Manager to store database passwords. They want to ensure that the secrets are encrypted with customer-managed keys (CMEK) and that applications can retrieve them without embedding the encryption key in the application. What should they configure?

   • AEncrypt the secret manually with a local key before storing it in Secret Manager and provide the key to the application.
   • BUse Secret Manager's built-in encryption and rely on IAM to restrict access to the secret.
   • CCreate a Cloud KMS key and set it as the encryption key for the secret, then grant the application's service account access to both Secret Manager and the KMS key.
   • DUse Google's default encryption and store the encryption key in the application's environment variables.
   Reveal Solution Discussion Select an answer first