Which authentication mechanism is commonly used to allow a cloud workload to securely retrieve secrets without storing long-term credentials?

Managed identity (e.g., AWS IAM Role, Azure Managed Identity) assigned to the workload.

Shared access keys stored in environment variables.

Client certificates stored in the application's source repository.

Hardcoded API keys in the application code.

A large enterprise uses a central secret management platform (e.g., HashiCorp Vault) to manage secrets for multiple teams. Each team has its own namespace and applications. The security team wants to enforce that applications can only read secrets from their own namespace and that all access is logged. They also want to minimize the number of authentication credentials to manage. Which approach should they take?

Use Vault's identity-based authentication (e.g., Kubernetes auth method) to map each application's service account to a Vault policy that grants read access only to its namespace, and enable audit logging.

Use Vault's approle auth method with a single role for all applications.

Create a shared Vault token for all applications and rely on namespace restrictions.

Store all secrets in a single namespace and use Vault's ACLs to restrict access.

Why should secrets never be written to application logs?

Logs are deleted after a short time, so secrets would be lost.

Logs are stored in a separate network that is inaccessible to attackers.

Logs are often stored in plaintext and may be accessible to a wider audience, leading to secret exposure.

Logs are automatically encrypted and cannot be read by humans.

What is a recommended method to inject secrets into a containerized application at runtime?

Embedding secrets in the container image.

Mounting secrets as volumes from a secret store (e.g., Kubernetes Secrets or cloud vault).

Passing secrets as command-line arguments.

Writing secrets to a shared network drive.

A company uses a central secrets vault. Each microservice needs to read only its own database credentials. The security team wants to ensure that a compromised service cannot access other services' secrets and that all access is logged. What is the most appropriate configuration?

Grant all services read access to all secrets to simplify management, and rely on network segmentation.

Store secrets in environment variables and restrict access via the container runtime.

Create a separate policy for each service that grants read access only to its own secret path, and enable audit logging on the vault.

Use a single shared secret for all services and rotate it monthly.

GIAC Cloud Security Automation

Domain 5Objective 2

Managing Secrets GCSA Practice Questions (Page 4)

Part of the Identity, Secrets, and Supply Chain domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 16–20

16foundation · easy
Which authentication mechanism is commonly used to allow a cloud workload to securely retrieve secrets without storing long-term credentials?
Select an answer first
17expert · hard
A large enterprise uses a central secret management platform (e.g., HashiCorp Vault) to manage secrets for multiple teams. Each team has its own namespace and applications. The security team wants to enforce that applications can only read secrets from their own namespace and that all access is logged. They also want to minimize the number of authentication credentials to manage. Which approach should they take?
Select an answer first
18foundation · easy
Why should secrets never be written to application logs?
Select an answer first
19foundation · easy
What is a recommended method to inject secrets into a containerized application at runtime?
Select an answer first
20application · medium
A company uses a central secrets vault. Each microservice needs to read only its own database credentials. The security team wants to ensure that a compromised service cannot access other services' secrets and that all access is logged. What is the most appropriate configuration?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.