Secrets Management GCLD Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   Which of the following is an example of monitoring secret usage to detect potential compromise?

   • AStoring the secret in a different region
   • BSetting up alerts for multiple failed access attempts to a secret
   • CChanging the secret's access policy to allow more users
   • DEncrypting the secret with a stronger algorithm
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   How should a cloud application retrieve a database password from a secrets management service?

   • ABy making an API call to the secrets management service at runtime using its authenticated identity
   • BBy embedding the password in the application's source code
   • CBy reading it from a configuration file that is included in the application package
   • DBy asking the user to enter the password each time the application starts
   Reveal Solution Discussion Select an answer first
4. 33foundation · easy

   What is the purpose of fine-grained access control for secrets?

   • ATo allow all users in the organization to read any secret
   • BTo encrypt secrets with different algorithms
   • CTo automatically rotate secrets on a schedule
   • DTo restrict which users, applications, or services can retrieve or modify specific secrets
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A company is migrating from storing secrets in environment variables to a centralized secrets manager. They have hundreds of applications, each with different secrets. The security team wants to minimize the risk of secrets being exposed during the migration. What is the BEST migration strategy?

   • AKeep environment variables as a fallback and only use the secrets manager for new applications.
   • BMigrate all applications at once to complete the process quickly.
   • CMigrate applications in phases, starting with low-risk applications, and use a secrets manager SDK to retrieve secrets dynamically.
   • DStore all secrets in a single secret in the secrets manager to simplify management.
   Reveal Solution Discussion Select an answer first
6. 35expert · hard

   A company uses Jenkins for CI/CD. They need to deploy to multiple cloud environments (dev, staging, prod) and want to ensure that production credentials are not accessible to developers or to jobs running for non-production branches. They also want to avoid storing credentials in Jenkins' global configuration. What is the best approach?

   • AHave the pipeline script read the production credentials from a file on the Jenkins master that is only readable by the Jenkins service account.
   • BStore production credentials in a shared Jenkins credential store and rely on the pipeline script to use them only for production branches.
   • CUse Jenkins credentials with a scope of 'System' and restrict the production credentials to a specific folder that only production pipeline jobs can access.
   • DUse a separate Jenkins instance for production deployments and store credentials in that instance's global configuration.
   Reveal Solution Discussion Select an answer first