A team is deploying a serverless function that needs to access a database secret. The function has a maximum execution time of 5 minutes. The team wants to avoid storing the secret in environment variables and ensure that the secret is rotated without redeploying the function. What is the best approach?

Embed the secret in the function code and update it when rotated.

Have the function retrieve the secret from a secret manager at runtime using its IAM role.

Use a long-lived secret in environment variables and rotate manually.

Store the secret in a configuration file in the function's deployment package.

A team wants to ensure that only the production application can read the production database password from the vault. The application runs in a specific Kubernetes namespace. What is the most secure way to grant access?

Use a Kubernetes service account with an IAM role that has a vault policy scoped to that namespace.

Store the vault token in a ConfigMap for easy access.

Use a static vault token that never expires.

Share the vault token among all pods in the cluster.

A DevOps team is building a CI/CD pipeline that deploys to multiple environments (dev, staging, prod). They want to use the same pipeline code but different secrets for each environment. They also want to ensure that secrets are not exposed to developers who only have access to the dev environment. What is the best approach?

Use a single secret with multiple versions and select the version based on the environment.

Store all secrets in a single secret store and use a pipeline variable to select the environment.

Create separate pipeline definitions for each environment.

Use environment-specific secret scopes in the CI/CD platform and reference them in the pipeline using environment variables.

A security analyst is reviewing logs from a cloud secret manager and notices that a service account is retrieving a secret every few minutes, which is unusual. The analyst suspects the service account may be compromised. What should the analyst do first to investigate?

Immediately rotate the secret and revoke the service account's access.

Check the audit logs for the source IP address and the pattern of access to determine if it is legitimate.

Ignore the activity because the secret manager is secure.

Disable the secret and wait to see if any application breaks.

Why is it important to set an expiration policy on secrets?

To reduce the storage cost of the secret.

To prevent users from accessing the secret after business hours.

To ensure secrets are automatically invalidated after a defined period, reducing the risk of long-term exposure.

To make the secret available to more applications.

GIAC Cloud Security Automation

Domain 5Objective 2

Managing Secrets GCSA Practice Questions (Page 2)

Part of the Identity, Secrets, and Supply Chain domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 6–10

6expert · hard
A team is deploying a serverless function that needs to access a database secret. The function has a maximum execution time of 5 minutes. The team wants to avoid storing the secret in environment variables and ensure that the secret is rotated without redeploying the function. What is the best approach?
Select an answer first
7application · medium
A team wants to ensure that only the production application can read the production database password from the vault. The application runs in a specific Kubernetes namespace. What is the most secure way to grant access?
Select an answer first
8expert · hard
A DevOps team is building a CI/CD pipeline that deploys to multiple environments (dev, staging, prod). They want to use the same pipeline code but different secrets for each environment. They also want to ensure that secrets are not exposed to developers who only have access to the dev environment. What is the best approach?
Select an answer first
9application · medium
A security analyst is reviewing logs from a cloud secret manager and notices that a service account is retrieving a secret every few minutes, which is unusual. The analyst suspects the service account may be compromised. What should the analyst do first to investigate?
Select an answer first
10foundation · easy
Why is it important to set an expiration policy on secrets?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.

Managing Secrets GCSA Practice Questions (Page 2)

Questions 6–10

A team wants to ensure that only the production application can read the production database password from the vault. The application runs in a specific Kubernetes namespace. What is the most secure way to grant access?

A security analyst is reviewing logs from a cloud secret manager and notices that a service account is retrieving a secret every few minutes, which is unusual. The analyst suspects the service account may be compromised. What should the analyst do first to investigate?

Why is it important to set an expiration policy on secrets?

Keep studying — Identity, Secrets, and Supply Chain