Secure Compute Deployment GCLD Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer is writing a script that runs on a cloud VM and needs to access a database. The script currently contains a hardcoded database password. The security team requires that no secrets be stored in the script or VM image. What should the developer do?

   • AUse a secrets management service to retrieve the database password at runtime, and grant the VM's IAM role permission to access that service.
   • BAsk the database administrator to create a new database user with a very long password and embed it in the script.
   • CStore the password in a file on the VM's disk and restrict file permissions.
   • DEncrypt the password in the script using a hardcoded encryption key.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A company is migrating a legacy application to a cloud VM. The application currently uses plain HTTP and stores data on an unencrypted disk. The security team requires encryption for data in transit and at rest. Which configuration should be applied?

   • AUse a VPN for all client connections and leave the disks unencrypted because the VPN protects the data.
   • BEncrypt the disks but continue using HTTP because the data is not sensitive.
   • CEnable TLS on the application and encrypt the VM's attached disks using the cloud provider's volume encryption feature.
   • DRely on the cloud provider's default network encryption and do not encrypt the disks.
   Reveal Solution Discussion Select an answer first
4. 13application · medium

   An application running on a cloud VM needs to access a secrets vault to retrieve database credentials. The security team wants to ensure that the VM's access to the vault is automatically rotated and that no static credentials are used. What should be configured?

   • AStore the vault's API key in the VM's metadata and have the application read it from there.
   • BAttach an IAM role to the VM that grants permission to read from the vault, and configure the vault to issue short-lived credentials.
   • CCreate a long-lived service account key and place it in the application's configuration file.
   • DUse the VM's default service account, which already has access to all vaults.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is required to comply with a regulation that mandates all production VMs be tagged with an owner and a data classification. The company also needs to ensure that only approved VM images are used. The security team wants to enforce this with minimal operational overhead. What is the most effective approach?

   • AUse a script that runs daily to find and terminate non-compliant VMs.
   • BCreate a shared documentation page and ask developers to follow it.
   • CUse a monitoring tool to alert on non-compliant VMs and manually fix them.
   • DImplement an organization policy that requires tags and restricts image usage at resource creation time.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An administrator needs to allow a DevOps engineer to SSH into a production VM. The company policy requires that the engineer's access be temporary and that no shared keys be used. Which approach should the administrator take?

   • AUse a privileged access management (PAM) solution that brokers SSH sessions and grants access only for the approved time window.
   • BShare a common SSH key among the team and rotate it monthly.
   • CAdd the engineer's personal SSH key to the VM and leave it there permanently for convenience.
   • DGenerate a dedicated key pair for the engineer, add the public key to the VM's authorized_keys, and revoke it after the task.
   Reveal Solution Discussion Select an answer first