Secrets Management GCLD Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A startup currently stores API keys and database passwords in environment variables on each application server. They want to move to a centralized secrets manager. What is the PRIMARY benefit they will gain?

   • AGuaranteed protection against all insider threats.
   • BElimination of all network latency when retrieving secrets.
   • CA single point of control for access policies, auditing, and rotation of all secrets.
   • DAutomatic encryption of all application data at rest.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company discovers that an API key used by a legacy application was exposed in a public GitHub repository. The key is stored in AWS Secrets Manager and the application retrieves it at startup. The security team needs to rotate the key immediately, but the legacy application does not support dynamic secret retrieval and caches the key for the entire process lifetime. What is the best course of action?

   • AImmediately revoke the key at the API provider and update the application configuration to use a new key, but do not rotate in Secrets Manager.
   • BRotate the secret in Secrets Manager, then restart the legacy application so it retrieves the new key.
   • CDisable the exposed secret version and rely on the application's cache to continue using it.
   • DDelete the exposed secret and create a new one with the same name, then update the application's IAM role to allow access to the new secret.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   What is the primary purpose of a secrets management solution in a cloud environment?

   • ATo monitor network traffic for malicious activity
   • BTo provide a backup and recovery solution for cloud virtual machines
   • CTo centrally store, control, and audit access to sensitive credentials such as API keys and passwords
   • DTo encrypt all data stored in cloud databases
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A security team wants to implement automated rotation for a database password. The database is used by a legacy application that does not support dynamic secret retrieval. What is the BEST way to handle rotation for this legacy application?

   • ADo not rotate the password because the legacy application cannot support it.
   • BManually update the password in the application's configuration file each time it is rotated.
   • CReplace the legacy application with a new application that supports dynamic secret retrieval.
   • DUse a secrets manager that can update the application's configuration file or environment variable with the new password, and restart the application after rotation.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A security engineer discovers that an API key used by a production service was exposed in a public code repository. The secrets manager supports versioning and automated rotation. What is the FIRST action the engineer should take?

   • ADelete the exposed API key from the secrets manager and wait for the service to fail before creating a new key.
   • BImmediately revoke the exposed API key and create a new version in the secrets manager, then update the service to use the new version.
   • CChange the permissions on the public repository to private and assume the key is no longer exposed.
   • DRotate the key using the secrets manager's automated rotation policy and wait for the next scheduled rotation.
   Reveal Solution Discussion Select an answer first