Managing Secrets GCSA Practice Questions (Page 8)

Questions 36–40

1. 36foundation · easy

   Why is it important to integrate secret management into CI/CD pipelines?

   • ATo speed up the build process by caching secrets.
   • BTo automatically deploy secrets to production without human review.
   • CTo prevent secrets from being exposed in build logs, artifacts, or source code.
   • DTo allow developers to view secrets in the pipeline UI.
   Reveal Solution Discussion Select an answer first
2. 37expert · hard

   A company is evaluating whether to use a cloud-native secret manager or a third-party vault. They have a requirement to store secrets in a specific geographic region to comply with data residency regulations. They also need to integrate with on-premises systems. What is the most important factor in this decision?

   • AThe cost of the solution compared to the third-party vault.
   • BThe brand reputation of the vendor.
   • CWhether the chosen solution supports deployment in the required region and provides integration options for on-premises access.
   • DThe number of features offered by the solution.
   Reveal Solution Discussion Select an answer first
4. 38foundation · easy

   Which of the following is a common feature of a secret storage solution like HashiCorp Vault?

   • AStoring secrets in plaintext in a configuration file.
   • BProviding a public API that anyone can access without authentication.
   • CAutomatically deploying secrets to all cloud regions without configuration.
   • DDynamic secret generation with lease durations and automatic revocation.
   Reveal Solution Discussion Select an answer first
5. 39application · medium

   A team is deploying a serverless function on AWS Lambda that needs to call an external API using a client secret. The team wants to avoid hardcoding the secret in the function code and avoid exposing it in environment variables that can be viewed by anyone with Lambda read access. Which approach should they use?

   • AStore the secret in AWS Secrets Manager and retrieve it at runtime using the Lambda execution role.
   • BSet the secret as an environment variable in the Lambda configuration and mark it as encrypted.
   • CUse AWS Systems Manager Parameter Store with a plaintext parameter.
   • DInclude the secret in the deployment package and read it from a file.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   An organization uses HashiCorp Vault to manage secrets for a legacy application that runs on a virtual machine. The application reads a database password from a file at startup. Security policy requires that the password be rotated every 24 hours and that the application always uses the current password without manual intervention. What should the team implement?

   • AManually rotate the password in Vault and update the file on the VM every day.
   • BUse Vault's static secret with a periodic rotation policy and restart the application after each rotation.
   • CUse Vault's dynamic database secrets engine to generate short-lived credentials and have the application fetch them from Vault at startup.
   • DSet a long TTL on the static secret in Vault and rely on the application to cache the password.
   Reveal Solution Discussion Select an answer first