Secrets Management GCLD Practice Questions (Page 9)

Questions 41–45

1. 41foundation · easy

   Which stage of the secret lifecycle involves permanently removing a secret from the system?

   • ARevocation
   • BDestruction
   • CRotation
   • DCreation
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Why is automated secret rotation considered a best practice?

   • AIt ensures that secrets are never stored in memory
   • BIt eliminates the need for access control on secrets
   • CIt makes secrets readable by all applications
   • DIt reduces the risk of a compromised secret being used for an extended period
   Reveal Solution Discussion Select an answer first
4. 43foundation · easy

   What is a recommended way to provide secrets to a CI/CD pipeline during a build?

   • AInclude the secrets as plaintext environment variables in the pipeline definition
   • BAsk a developer to manually enter the secret each time the pipeline runs
   • CReference the secrets from a secrets management service using the pipeline's authenticated identity
   • DHardcode the secrets in the build script
   Reveal Solution Discussion Select an answer first
5. 44application · medium

   A company currently stores database credentials in a plaintext configuration file on each application server. They want to move to a centralized secrets management solution to improve security and simplify rotation. What is the first step they should take?

   • AMigrate the credentials to a dedicated secrets management service and update applications to retrieve them dynamically.
   • BEncrypt the configuration file with a local key and store the key in a separate file.
   • CUse environment variables to store the credentials and set them in the server's startup script.
   • DMove the configuration file to a shared network drive and restrict access to it.
   Reveal Solution Discussion Select an answer first
6. 45expert · hard

   A company uses a centralized secrets manager (e.g., AWS Secrets Manager) for all application secrets. They have multiple AWS accounts: production, staging, and development. They want to allow applications in each account to retrieve only the secrets that belong to their environment, and they want to avoid duplicating secrets across accounts. What is the most secure and maintainable approach?

   • AStore all secrets in a shared secrets manager and grant all application roles full access to simplify management.
   • BUse AWS Systems Manager Parameter Store in each account and store secrets as plaintext parameters.
   • CCreate a separate secrets manager instance in each account and replicate secrets using cross-account replication.
   • DCreate a single secrets manager instance in a central account and use resource-based policies that allow each application's IAM role to access only the secrets with a specific environment tag.
   Reveal Solution Discussion Select an answer first