Managing Secrets GCSA Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A security team wants to implement a zero-trust model for secret access. They want to ensure that every request to the vault is authenticated and authorized based on the workload's identity, not just a static token. What should they implement?

   • AUse short-lived tokens generated from workload identity (e.g., OIDC) and enforce policies based on that identity.
   • BUse a long-lived static token shared across all workloads.
   • CRely on network segmentation to protect the vault.
   • DUse a single admin account for all vault access.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A security architect is designing access control for a secrets vault used by multiple teams. Each team has its own namespace, but some teams need to share a few secrets. The architect wants to enforce least privilege while allowing sharing and maintaining auditability. What is the best design?

   • AGive all teams full access to all namespaces to simplify collaboration.
   • BUse a single namespace for all secrets and rely on application-level access control.
   • CCreate a shared namespace for common secrets and grant each team read access only to that namespace and their own namespace.
   • DDuplicate shared secrets into each team's namespace and manage them separately.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a legacy application that reads a database password from a configuration file at startup. The security team wants to implement automated rotation without modifying the application code. The application runs on a virtual machine and cannot be restarted frequently. What is the best approach?

   • AStore the secret in a shared file and rely on file permissions.
   • BUse a secrets agent that periodically updates the configuration file and signals the application to reload it.
   • CManually update the configuration file every time the secret rotates.
   • DChange the application to read from the vault API directly.
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company is evaluating whether to use a cloud-native secret manager (e.g., AWS Secrets Manager) or a third-party solution (e.g., HashiCorp Vault) for multi-cloud environments. The company uses AWS and Azure and wants a consistent way to manage secrets across both clouds. They also need to support dynamic secrets for database access. Which solution is most appropriate?

   • AUse Azure Key Vault because it integrates well with Azure services.
   • BUse a combination of AWS Secrets Manager and Azure Key Vault and manage them separately.
   • CUse HashiCorp Vault because it provides a cloud-agnostic API and supports dynamic secrets across multiple clouds.
   • DUse AWS Secrets Manager because it is the most popular cloud secret manager.
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   A company uses GitLab CI/CD to deploy an application to Google Cloud Run. The deployment requires a service account key to authenticate. The security team wants to avoid storing the key in the repository and wants to rotate it automatically. What is the best practice?

   • AUse Workload Identity Federation to allow GitLab to impersonate a Google service account without a long-lived key.
   • BGenerate a new service account key for every pipeline run and store it in a shared bucket.
   • CCommit the service account key to the repository and use a pre-commit hook to redact it.
   • DStore the service account key as a CI/CD variable and reference it in the pipeline.
   Reveal Solution Discussion Select an answer first