Managing Secrets GCSA Practice Questions (Page 6)

Questions 26–30

1. 26application · medium

   A CI/CD pipeline needs to deploy an application that requires a database password. The team wants to ensure that the password is not visible in the pipeline logs and is rotated automatically. What is the best practice?

   • AUse the same password for all environments to simplify management.
   • BUse a secrets manager to generate a temporary credential that the pipeline retrieves and injects at deployment.
   • CHardcode the password in the deployment script and restrict access to the script.
   • DStore the password in a pipeline variable and print it during deployment for debugging.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   A startup stores database credentials in a plaintext configuration file that is committed to a private Git repository. After a security review, they want to move to a managed secret store. The team also needs to know which developers accessed the credentials and when. Which combination of actions should they take?

   • AUse environment variables in the application and remove the configuration file.
   • BMove the repository to a private cloud storage bucket and restrict access to the file.
   • CMigrate secrets to a cloud secret manager, remove them from the repository, and enable audit logging on the secret manager.
   • DEncrypt the configuration file with a shared password and store the password in the repository.
   Reveal Solution Discussion Select an answer first
4. 28expert · hard

   A security analyst is investigating a potential secret leak. They see that a service account has accessed a secret outside of its normal pattern. The analyst needs to determine if the access was legitimate. What is the most effective way to correlate the access with a specific workload?

   • ALook at the vault's encryption key rotation logs.
   • BEnable detailed audit logs that include the workload identity and source IP, and correlate with deployment events.
   • CCheck the service account's password change history.
   • DReview the application's source code for hardcoded secrets.
   Reveal Solution Discussion Select an answer first
5. 29expert · hard

   A team is implementing automated rotation for a database password. The application uses a connection pool and does not handle connection failures gracefully. The team wants to minimize downtime during rotation. What is the best strategy?

   • ADo not rotate the password to avoid any risk of downtime.
   • BRotate the password and immediately restart the application to force a reconnect.
   • CUse a two-step rotation where the new password is added as an alternate and the old one is removed after the application has successfully reconnected.
   • DRotate the password during off-peak hours and accept brief downtime.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   A company uses AWS Secrets Manager to store API keys for multiple microservices. Each microservice runs on an EC2 instance with an IAM role. The security team wants to ensure that each microservice can only access its own secrets and that access is logged. What should they configure?

   • AGrant all microservices full access to Secrets Manager and rely on resource-based policies to restrict access.
   • BStore all secrets in one secret and use versioning to differentiate between microservices.
   • CUse a single IAM role for all microservices and add a condition to the policy that checks the secret name.
   • DCreate a separate IAM policy for each microservice's role that allows 'secretsmanager:GetSecretValue' only on the specific secret ARN, and enable CloudTrail for Secrets Manager.
   Reveal Solution Discussion Select an answer first