Multicloud and Credential Management Fundamentals GPCS Practice Questions (Page 5)

Questions 21–25

1. 21foundation · easy

   What control is most important during the revocation stage of a credential's lifecycle?

   • AEnsuring the credential is immediately invalidated
   • BRotating the credential to a new value
   • CArchiving the credential for future use
   • DNotifying all users of the credential
   Reveal Solution Discussion Select an answer first
2. 22application · medium

   A company must comply with a regulation that requires all access to production credentials to be individually attributable. The company uses shared service accounts in AWS and Azure. Which control is most directly required to meet this requirement?

   • AReplace shared service accounts with per-user identities and use federation to obtain short-lived credentials.
   • BStore the shared credentials in a vault and require users to check them out for a limited time.
   • CImplement a break-glass process that allows emergency access to shared accounts with manager approval.
   • DEnable cloud trail logging for all API calls made with the shared credentials.
   Reveal Solution Discussion Select an answer first
4. 23application · medium

   A DevOps team manages infrastructure in AWS, Azure, and GCP. They need to rotate database passwords used by applications in all three clouds every 60 days. The team wants to avoid manual work and ensure that no application downtime occurs during rotation. Which approach best meets these requirements?

   • AUse a secrets manager that supports scheduled rotation and update the applications to fetch credentials dynamically at runtime.
   • BManually update the passwords in each cloud's configuration file and restart the applications during a maintenance window.
   • CSet the database password to never expire and rely on network security groups to restrict access.
   • DCreate a script that updates the password in the database and then updates the connection string in each application's environment variables.
   Reveal Solution Discussion Select an answer first
5. 24expert · hard

   A company operates in a regulated industry and must demonstrate to auditors that access to production credentials is restricted and monitored. The company uses AWS and Azure. Which combination of controls provides the strongest evidence for compliance?

   • AUse a spreadsheet to track who has access to credentials and review it quarterly.
   • BUse each cloud's native secrets manager and rely on the cloud provider's default logging.
   • CStore credentials in a vault and grant access to all administrators to simplify management.
   • DUse a centralized secrets manager with access logging, and configure alerts for any access outside business hours.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company uses AWS and Azure. The security team must rotate service account keys every 30 days. The team currently uses a manual process that often misses the deadline. The company wants to automate rotation without storing plaintext keys in the CI/CD pipeline. Which solution is most effective?

   • AWrite a custom script that runs on a scheduled basis to rotate keys in both clouds and store the new keys in a shared Git repository.
   • BManually rotate keys every 30 days and use a spreadsheet to track the rotation dates.
   • CUse a third-party secrets management tool that supports both clouds, but require the pipeline to use a long-lived API token to authenticate to the tool.
   • DUse AWS Secrets Manager to rotate AWS keys and Azure Key Vault to rotate Azure keys, and configure the CI/CD pipeline to retrieve the current key from each service at deployment time.
   Reveal Solution Discussion Select an answer first