Managing Secrets GCSA Practice Questions (Page 7)

Questions 31–35

1. 31expert · hard

   A security analyst is investigating a potential secret leak. The audit logs show that a secret was retrieved by a service account from an unexpected IP address. The analyst also notices that the secret was used to authenticate to an external service. What should the analyst do first?

   • AContact the external service provider to ask if the secret was used legitimately.
   • BWait for more data to confirm the leak before taking action.
   • CCheck if the IP address belongs to a known internal network.
   • DRevoke the service account's access to the secret and rotate the secret immediately.
   Reveal Solution Discussion Select an answer first
2. 32application · medium

   A company uses a third-party vault for secrets but wants to move to a cloud-native solution to reduce operational overhead. They need to maintain fine-grained access control and audit capabilities. What should they consider?

   • AUse a single shared secret for all applications to simplify migration.
   • BKeep the third-party vault and manually replicate audit logs to the cloud.
   • CStore secrets in plaintext in a database and restrict access via network rules.
   • DMigrate to the cloud provider's secret manager and map existing policies to IAM roles.
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security engineer is designing a secret rotation strategy for a critical application that uses a static API key stored in a cloud secret manager. The application caches the key in memory and only refreshes it when it receives a 401 response. The security team wants to rotate the key every 30 days without causing downtime. What is the best approach?

   • ARotate the key immediately and delete the old key from the secret manager.
   • BRotate the key in the secret manager and update the application to fetch the new key on 401 responses, ensuring the old key remains valid for a grace period.
   • CRotate the key and restart the application to force it to reload the secret.
   • DDo not rotate the key because the application caches it and rotation would break the application.
   Reveal Solution Discussion Select an answer first
5. 34application · medium

   A CI/CD pipeline builds a container image and needs to pass a database password to the application at runtime. The team wants to avoid embedding the secret in the image or exposing it in build logs. What should they do?

   • AInject the secret as an environment variable from the CI/CD system's secret store at container startup.
   • BWrite the secret to a file in the image during the build and delete it after startup.
   • CPass the secret as a command-line argument to the container.
   • DHardcode the secret in the source code and rely on repository access controls.
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A DevOps team deploys a containerized application to Azure Kubernetes Service (AKS). The application needs a database connection string and an API key at runtime. The team currently stores these secrets as Kubernetes Secrets and references them as environment variables. Security review requires that secrets be rotated automatically and that only the application pod's service account can read them. Which approach best meets the requirement?

   • AUse the Secrets Store CSI driver to mount secrets from Azure Key Vault into the pod, and configure a Key Vault access policy for the pod's managed identity.
   • BContinue using Kubernetes Secrets but set a short TTL on the Secret object and rely on RBAC to restrict access to the secret.
   • CStore the secrets in a ConfigMap and use a Kubernetes CronJob to update the ConfigMap every 30 days.
   • DUse the AKS cluster's built-in encryption to encrypt Kubernetes Secrets and mount them as files.
   Reveal Solution Discussion Select an answer first