Edge Identity and Authentication GCSA Practice Questions (Page 4)

Questions 16–20

1. 16foundation · easy

   In a cloud-native environment with workloads distributed across multiple edge locations, what is the primary purpose of an edge identity?

   • ATo provide a unique, verifiable identity for each device, workload, or service at the edge, enabling secure authentication and authorization
   • BTo replace the need for network-level encryption between edge nodes
   • CTo store all edge device credentials in a central database for easy access by any service
   • DTo assign a static IP address to every edge device for simplified network management
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company uses edge devices that run software from multiple vendors. They want to ensure that each component's integrity is verified throughout the supply chain. Which approach is most comprehensive?

   • ARely on the vendor's reputation and trust their software.
   • BUse a vulnerability scanner to check for known vulnerabilities in the components.
   • CUse a software bill of materials (SBOM) and verify signatures on each component at build time, deployment time, and runtime.
   • DVerify the signature of the final device image only.
   Reveal Solution Discussion Select an answer first
4. 18expert · hard

   A healthcare provider uses edge devices that collect patient data and send it to a cloud backend. The devices authenticate using client certificates. The security team wants to implement zero trust principles, including continuous verification and least privilege. They also need to revoke access quickly if a device is compromised. Which combination of controls best meets these requirements?

   • AIssue long-lived certificates and rely on the certificate revocation list (CRL) to block compromised devices.
   • BIssue short-lived certificates with frequent renewal and require the backend to validate the device's posture and behavior on each request.
   • CAuthenticate devices with a shared secret and rely on network segmentation to limit access.
   • DUse a static API key per device and rotate it monthly.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A logistics company runs containerized applications on edge devices in delivery trucks. The applications need database credentials to connect to a central cloud database. Currently, the credentials are stored in a plaintext environment variable in the container manifest. The security team wants to reduce the risk of credential exposure while keeping the ability to rotate credentials without redeploying the containers. Which approach best meets the requirement?

   • AUse a secrets management service that injects credentials into the container at runtime via a sidecar or SDK.
   • BHardcode the credentials in the application source code and build them into the image.
   • CEncrypt the environment variable using a key stored in the container image.
   • DStore the credentials in a Kubernetes Secret and mount them as a volume.
   Reveal Solution Discussion Select an answer first
6. 20expert · hard

   A company has edge devices that authenticate using tokens issued by an identity provider. They want to implement zero trust by continuously verifying the user's access. Which approach is most effective?

   • AUse short-lived tokens and require the edge service to validate the token's signature, expiry, and audience on every request.
   • BUse long-lived tokens and validate them only at the start of a session.
   • CUse a shared token for all users and rely on the network to restrict access.
   • DUse a static API key for each user and rotate it monthly.
   Reveal Solution Discussion Select an answer first