Store and Manage Security Data CSSLP Practice Questions (Page 5)

Questions 21–25

1. 21expert · medium

   A large organization has multiple development teams that need to access secrets in a central vault. The security team wants to ensure that each team can only access the secrets they need, and that all access is logged. What is the best way to configure the vault?

   • AGive all teams the same access to the vault to simplify management.
   • BUse a shared service account for all teams to access the vault.
   • CStore all secrets in a single location and rely on the application to filter access.
   • DCreate separate namespaces or paths for each team and assign least-privilege policies to each team's service accounts.
   Reveal Solution Discussion Select an answer first
2. 22expert · medium

   A company uses a hardware security module (HSM) to store cryptographic keys. They need to allow multiple applications to use the keys without exposing the keys themselves. They also need to ensure that key usage is audited. What should they implement?

   • AExport the keys from the HSM and store them in a software vault for easier access.
   • BUse the HSM only for key generation and store the keys in a database.
   • CUse the HSM's key management interface to allow applications to request cryptographic operations without exporting the keys.
   • DShare the HSM's master key with all applications.
   Reveal Solution Discussion Select an answer first
4. 23foundation · easy

   What is a key benefit of using a dedicated secrets management vault over storing secrets in configuration files?

   • AVaults eliminate the need for encryption because they are trusted
   • BVaults provide encryption at rest and access control for secrets
   • CVaults store secrets in plaintext for faster access
   • DVaults automatically make secrets available to anyone on the network
   Reveal Solution Discussion Select an answer first
5. 24foundation · easy

   Which principle is central to secrets management when granting access to a vault?

   • AGrant access to all secrets but log all access for auditing
   • BGrant access only to the minimum set of secrets required for a role or task
   • CGrant access based on the seniority of the employee
   • DGrant all developers access to all secrets to avoid delays
   Reveal Solution Discussion Select an answer first
6. 25foundation · easy

   Which of the following is a primary characteristic of a credential type commonly used for non-interactive service-to-service authentication?

   • AA biometric sample such as a fingerprint stored in a database
   • BA certificate or token that is machine-readable and can be rotated automatically
   • CA password that is shared among all members of a development team
   • DA one-time password (OTP) generated by a hardware token for each login
   Reveal Solution Discussion Select an answer first