Multicloud and Credential Management Fundamentals GPCS Practice Questions (Page 4)

Questions 16–20

1. 16expert · hard

   A company uses AWS and Azure. The security team wants to implement a solution that automatically rotates database credentials for applications running in both clouds. The applications are deployed on EC2 instances in AWS and Azure VMs. Which solution is most effective?

   • AUse a central secrets management solution that supports both clouds, such as HashiCorp Vault, and have applications in both clouds retrieve credentials from Vault.
   • BUse AWS Secrets Manager for AWS applications and Azure Key Vault for Azure applications, and manually synchronize the rotated credentials between the two services.
   • CUse Azure Key Vault to rotate the database credentials and have the applications retrieve the credentials from Key Vault at runtime.
   • DUse AWS Secrets Manager to rotate the database credentials and have the applications retrieve the credentials from Secrets Manager at runtime.
   Reveal Solution Discussion Select an answer first
2. 17expert · hard

   A company must comply with a regulation that requires all access to production credentials to be logged and reviewed. The company uses a centralized secrets manager. Which control is most effective for meeting the review requirement?

   • AEnable basic logging and review the logs only when an incident occurs.
   • BUse the cloud provider's default logging and rely on the provider to review the logs.
   • CEnable detailed audit logging on the secrets manager and schedule regular reviews of the logs.
   • DStore logs in a separate system and archive them without review.
   Reveal Solution Discussion Select an answer first
4. 18application · medium

   A startup uses AWS and Azure. Developers need temporary credentials to access resources in both clouds from their local machines. The company wants to avoid storing long-lived access keys on developer laptops. Which approach best meets this requirement?

   • AIssue each developer a long-lived access key pair for both AWS and Azure, and instruct them to store the keys in their local password manager.
   • BCreate a shared service account in each cloud and distribute the keys to developers via a secure chat channel.
   • CUse AWS SSO and Azure AD to provide federated access, but require developers to manually copy the temporary credentials from the console into their CLI configuration.
   • DConfigure AWS IAM Roles Anywhere and Azure AD-managed identities for developers, and use a local agent to obtain short-lived credentials from each cloud.
   Reveal Solution Discussion Select an answer first
5. 19application · medium

   A company is considering a multicloud strategy to avoid vendor lock-in. The CTO wants to ensure that identity and access management (IAM) policies are portable across clouds. Which approach best supports this goal?

   • AAdopt an abstraction layer such as a cloud-agnostic policy-as-code tool (e.g., Open Policy Agent) that can generate provider-specific policies.
   • BUse each cloud provider's native IAM service and manually translate policies when moving workloads.
   • CUse a single cloud provider for all IAM and rely on federation to access other clouds.
   • DStore all IAM policies in a central Git repository and manually copy them to each cloud.
   Reveal Solution Discussion Select an answer first
6. 20application · medium

   A company is implementing a credential lifecycle policy. Which set of stages, in the correct order, represents the credential lifecycle?

   • AProvision, use, rotate, revoke, and destroy
   • BCreate, share, store, and delete
   • CGenerate, distribute, monitor, and archive
   • DRequest, approve, issue, and forget
   Reveal Solution Discussion Select an answer first