7.4 Identify and Describe the Components of Secrets Management CYBERSECURITY-APPRENTICE Practice Questions (Page 3)

Questions 11–15

1. 11application · medium

   A developer at a financial services company needs to store an API key used by a backend service to authenticate to a third-party payment gateway. The company policy requires that the key be encrypted at rest and that access be limited to the specific application service account. Which approach best meets these requirements?

   • APlace the API key in a plain-text configuration file on the application server.
   • BShare the API key with all developers via a shared document for easy access.
   • CStore the API key in a secrets management service with access policies scoped to the service account.
   • DEmbed the API key in the application source code so it is versioned with the codebase.
   Reveal Solution Discussion Select an answer first
2. 12expert · hard

   A company is migrating from on-premises servers to a cloud environment. Their application uses a database password that is currently stored in a plain-text config file. The security team requires that the password be rotated automatically and that access be auditable. The operations team wants to minimize changes to the application code. Which solution best meets these requirements?

   • AStore the password in the cloud provider's object storage and have the application download it at startup.
   • BUse a secrets management service with a sidecar agent that injects the password into the application's environment at runtime.
   • CUse a configuration management tool to push the password to the server during deployment.
   • DModify the application to read the password from a local file that is updated by a cron job.
   Reveal Solution Discussion Select an answer first
4. 13expert · hard

   A company has a legacy application that reads a database password from a local file. The security team wants to move to a secrets management service, but the application cannot be modified. Which strategy is the most effective?

   • AAsk the vendor to provide a new version of the application that supports secrets managers.
   • BUse a file-based secret injection tool that syncs the secret from the secrets manager to the local file with restricted permissions.
   • CCreate a symbolic link from the local file to a file on a network share.
   • DEncrypt the local file and store the decryption key in the application's startup script.
   Reveal Solution Discussion Select an answer first
5. 14foundation · easy

   In a CI/CD pipeline, what is the recommended way to provide secrets to a build job?

   • APass them as command-line arguments in the pipeline definition
   • BInclude them in the repository as encrypted files
   • CEmbed them directly in the pipeline YAML file
   • DInject them as environment variables from a secure secrets store
   Reveal Solution Discussion Select an answer first
6. 15application · medium

   An application uses an SSH key to connect to a remote server for file transfers. The key is stored in a shared network folder. Which action would best protect the SSH key?

   • ACompress the key file and set a password on the archive.
   • BChange the file extension to .bak to hide it.
   • CMove the key to a secrets management service and configure the application to retrieve it at runtime.
   • DCopy the key to a USB drive and store it in a safe.
   Reveal Solution Discussion Select an answer first