A company uses Azure Key Vault to store certificates for mutual TLS authentication between services. They need to automatically rotate the certificates before they expire and ensure that services can continue to operate during the rotation without downtime. What should they implement?

Generate a long-lived certificate (e.g., 10 years) to avoid frequent rotation.

Store the certificate in a file on each virtual machine and use a scheduled task to update it before expiry.

Manually create a new certificate and update each service's configuration to point to the new version.

Configure Key Vault certificate auto-rotation with a validity period and use the Key Vault certificate endpoint so services always retrieve the current version.

A security team is investigating a potential secret leak. They have audit logs from their secrets manager, but the logs are stored in a separate SIEM. They need to correlate secret access events with user identity and determine if any secrets were accessed from an unusual location. What is the most effective way to perform this analysis?

Export the audit logs to a spreadsheet and manually compare timestamps with employee work hours.

Use the secrets manager's built-in anomaly detection to automatically identify suspicious access.

Query the SIEM for all secret access events, join them with identity provider logs, and filter by source IP and time.

Review the secrets manager's audit logs directly and look for any access from IP addresses not in the company's allowlist.

A company's security policy requires that when an employee leaves the organization, all secrets that the employee had access to must be immediately invalidated and replaced. The secrets manager supports versioning. What is the BEST way to handle this?

Change the employee's password and keep the same secrets.

Delete the employee's user account and assume the secrets are safe.

Revoke the employee's access to the secrets manager, then rotate all secrets the employee could access.

Disable versioning on the secrets manager to prevent rollback.

Which of the following is a common example of a 'secret' that a secrets management solution is designed to protect?

A virtual machine's public IP address

A database connection string containing a username and password

A public encryption key used for verifying digital signatures

GIAC Cloud Security Essentials

Domain 3Objective 2

Secrets Management GCLD Practice Questions (Page 6)

Part of the Identity, Access, and Secrets domain, which makes up ~15% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~8–12 in this domain), expect 4–6 from this objective — we provide 51 practice questions to prepare you well beyond it. (estimate)

51questions here

11free pages

10concepts

Questions 26–30

26application · medium
A company uses Azure Key Vault to store certificates for mutual TLS authentication between services. They need to automatically rotate the certificates before they expire and ensure that services can continue to operate during the rotation without downtime. What should they implement?
Select an answer first
27expert · hard
A security team is investigating a potential secret leak. They have audit logs from their secrets manager, but the logs are stored in a separate SIEM. They need to correlate secret access events with user identity and determine if any secrets were accessed from an unusual location. What is the most effective way to perform this analysis?
Select an answer first
28application · medium
A company's security policy requires that when an employee leaves the organization, all secrets that the employee had access to must be immediately invalidated and replaced. The secrets manager supports versioning. What is the BEST way to handle this?
Select an answer first
29foundation · easy
Which of the following is a common example of a 'secret' that a secrets management solution is designed to protect?
Select an answer first
30foundation · easy
Which principle is most directly applied when granting a specific application access only to the secrets it needs and nothing more?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCLD

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCLD” is a trademark of its owner, used for identification only.

Secrets Management GCLD Practice Questions (Page 6)

Questions 26–30

A company uses Azure Key Vault to store certificates for mutual TLS authentication between services. They need to automatically rotate the certificates before they expire and ensure that services can continue to operate during the rotation without downtime. What should they implement?

A company's security policy requires that when an employee leaves the organization, all secrets that the employee had access to must be immediately invalidated and replaced. The secrets manager supports versioning. What is the BEST way to handle this?

Which of the following is a common example of a 'secret' that a secrets management solution is designed to protect?

Which principle is most directly applied when granting a specific application access only to the secrets it needs and nothing more?

Keep studying — Identity, Access, and Secrets