Managing Secrets GCSA Practice Questions (Page 9)

Questions 41–44

1. 41application · medium

   A DevOps team stores database credentials in a cloud KMS. They need to rotate the credentials automatically every 30 days and ensure that the application retrieves the latest version without a restart. The application currently reads the secret once at startup from a mounted file. What should the team implement?

   • AStore the new secret in a different key and update the application configuration manually each rotation.
   • BUse a static secret that never rotates to avoid application downtime.
   • CEncrypt the secret with KMS and store it in a configuration file that is redeployed with the application.
   • DUse a secret manager that supports versioned secrets and have the application poll for the latest version periodically.
   Reveal Solution Discussion Select an answer first
2. 42foundation · easy

   Which statement best defines a secret in the context of cloud security?

   • AA configuration file that contains non-sensitive settings for an application.
   • BA piece of sensitive data, such as an API key or password, used to authenticate or authorize access to a resource.
   • CA unique identifier assigned to a cloud resource for tracking purposes.
   • DA publicly available encryption algorithm used to protect data at rest.
   Reveal Solution Discussion Select an answer first
4. 43application · medium

   A security engineer is configuring Azure Key Vault for a microservices application. The requirement is to detect when an unauthorized principal attempts to read a secret and to alert on repeated failures. The engineer has already enabled diagnostic settings to send Key Vault audit events to a Log Analytics workspace. What should the engineer do next to meet the requirement?

   • AConfigure a Key Vault access policy that denies all users except the application's service principal.
   • BUse Azure Policy to enforce that all Key Vaults have soft-delete enabled.
   • CCreate an Azure Monitor alert rule that triggers on the 'SecretGet' operation with a failed result, and set an action group to notify the security team.
   • DEnable the Key Vault firewall to block all public access and allow only specific virtual networks.
   Reveal Solution Discussion Select an answer first
5. 44foundation · easy

   Which practice is recommended for using secrets in a CI/CD pipeline?

   • AHardcoding secrets in the build script.
   • BStoring secrets in environment variables in the pipeline configuration file.
   • CUsing the same secret for all environments to simplify management.
   • DRetrieving secrets dynamically from a secret manager during the pipeline run.
   Reveal Solution Discussion Select an answer first