Managing Secrets GCSA Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A development team wants to integrate secret management into their CI/CD pipeline. They need to ensure that secrets are available to build jobs but are not stored in the pipeline configuration repository. What is the best approach?

   • AAsk developers to enter secrets manually each time a build runs.
   • BStore secrets in a text file in the repository and read them during the build.
   • CUse the CI/CD system's built-in secret store and reference secrets by name in the pipeline configuration.
   • DEncrypt secrets with a hardcoded key in the pipeline script.
   Reveal Solution Discussion Select an answer first
2. 2application · medium

   An organization has a policy that all secrets must expire and be rotated automatically. They also need to be alerted if a secret is accessed outside business hours. What should they configure?

   • AUse long-lived secrets and monitor access logs weekly.
   • BDisable expiration to avoid service disruptions and rely on manual reviews.
   • CRotate secrets only when a breach is suspected.
   • DSet expiration dates on secrets and enable audit logging with alerts for unusual access times.
   Reveal Solution Discussion Select an answer first
4. 3application · medium

   A security analyst notices that a service account is querying the secrets vault more frequently than expected. The team needs to determine whether this is legitimate behavior or a sign of compromise. What should they review first?

   • AAudit logs from the vault showing which secrets were accessed, by whom, and from which source IP.
   • BThe vault's encryption keys to check for unauthorized copies.
   • CThe service account's password hash to see if it was changed.
   • DThe application's source code to see if it logs secrets.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   What is the principle of least privilege in the context of secret access?

   • AGranting all users the same level of access to simplify management.
   • BGranting administrators the ability to read all secrets, while others have none.
   • CGranting access to secrets only during business hours.
   • DGranting each user or application only the permissions necessary to perform its function.
   Reveal Solution Discussion Select an answer first
6. 5foundation · easy

   What is the primary purpose of secret rotation?

   • ATo limit the window of opportunity for an attacker who has compromised a secret.
   • BTo increase the length of the secret to make it harder to guess.
   • CTo ensure the secret is stored in multiple locations for redundancy.
   • DTo make the secret readable by all authorized users.
   Reveal Solution Discussion Select an answer first