What is a primary risk of hardcoding secrets in application source code?

Hardcoded secrets reduce the performance of the application.

Secrets become visible to anyone with access to the code repository, increasing the chance of exposure.

Hardcoded secrets are automatically rotated by the cloud provider.

Hardcoded secrets are encrypted by default in version control systems.

A company is comparing cloud-native secret storage with a third-party vault. They require automatic rotation, fine-grained access control, and integration with their cloud IAM. Which solution best meets these requirements?

Encrypted files stored in cloud object storage with access via storage keys.

Environment variables set at deployment time with no central management.

Third-party vault with manual rotation and static access policies.

Cloud-native secret manager with IAM integration and rotation policies.

An application needs to retrieve a secret at runtime, but the team wants to avoid exposing the secret in environment variables or logs. What is the best method for secret injection?

Use a secrets agent that mounts the secret as a file in a tmpfs volume.

Write the secret to a standard file in the container's writable layer.

Include the secret in the container image as a label.

Pass the secret via a command-line argument.

A security team wants to detect if a compromised application is exfiltrating secrets by making unusual vault API calls. What should they enable?

Regular backups of the vault database.

Stronger password policies for vault users.

Detailed audit logging on the vault and alerts for anomalous access patterns.

Network-level encryption for all vault traffic.

What is the primary goal of auditing secret usage?

To automatically rotate secrets when they are used.

To prevent all access to secrets by blocking requests.

To detect unauthorized access or misuse of secrets by analyzing logs.

GIAC Cloud Security Automation

Domain 5Objective 2

Managing Secrets GCSA Practice Questions (Page 5)

Part of the Identity, Secrets, and Supply Chain domain, which makes up ~18% of our current practice bank. GIAC (SANS) does not publish an official question count, but from its 120-minute exam (~50–80 total, ~9–14 in this domain), expect 3–5 from this objective — we provide 44 practice questions to prepare you well beyond it. (estimate)

44questions here

9free pages

7concepts

Questions 21–25

21foundation · easy
What is a primary risk of hardcoding secrets in application source code?
Select an answer first
22application · medium
A company is comparing cloud-native secret storage with a third-party vault. They require automatic rotation, fine-grained access control, and integration with their cloud IAM. Which solution best meets these requirements?
Select an answer first
23application · medium
An application needs to retrieve a secret at runtime, but the team wants to avoid exposing the secret in environment variables or logs. What is the best method for secret injection?
Select an answer first
24application · medium
A security team wants to detect if a compromised application is exfiltrating secrets by making unusual vault API calls. What should they enable?
Select an answer first
25foundation · easy
What is the primary goal of auditing secret usage?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to GCSA

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by GIAC (SANS). “GCSA” is a trademark of its owner, used for identification only.