I85PREP
⌘ K
Delinea Secret Server study materials
Delinea Secret Server study resources

Delinea Secret Server practice questions

One question at a time. Build your Delinea Secret Server understanding.

First 50 of 200 questions. Each one lists the choices, the correct answer, and an explanation. The checker at the top of this page saves progress in this browser when it is available.

Continue in the practice tool above to load more questions, 50 at a time.

Question 1Secret Server Fundamentals and Vaulting

In Secret Server, what is the primary purpose of a secret template?

  1. To replicate the database to a disaster-recovery vault server
  2. To assign licensing seats to Secret Server users
  3. To define the fields, launchers, and behavior that a class of secret will share Correct answer.
  4. To schedule automatic password rotation for every user account in the domain

Explanation

A template is the blueprint for a category of secret: it determines which fields appear, which launchers are available, and how the secret behaves. Secrets are always created from a template, so the template controls the structure rather than the licensing or replication layer.

Question 2Secret Server Fundamentals and Vaulting

A Secret Server administrator wants a secret to require an approval workflow before any user can view it. Which configuration point controls that?

  1. The launcher's connection type
  2. The secret's access control list and its require-approval option Correct answer.
  3. The folder's inheritance setting
  4. The site's session recording policy

Explanation

Requiring approval is an access-control behavior set on the secret (or inherited from a folder) through the secret's security settings. Approval then gates retrieval so that a user must request and be granted access before the value is revealed.

Question 3Secret Server Fundamentals and Vaulting

What does Secret Server's remote password changing (RPC) feature do?

  1. Forces users to change their Secret Server login password
  2. Synchronizes secrets between two Secret Server instances
  3. Rotates a secret's password on the target system and stores the new value Correct answer.
  4. Encrypts the Secret Server database at rest

Explanation

Remote password changing uses a dependency and a password changer to reset the credential on the target system, then writes the new value back into the secret. It is about keeping managed credentials current, not about database encryption or user logins.

Question 4Secret Server Fundamentals and Vaulting

Which Secret Server component stores the encryption keys used to protect secret data?

  1. The vault or key store configured for the installation Correct answer.
  2. The web node's application pool identity
  3. The database's secret table
  4. The distributed engine cache

Explanation

Secret data is encrypted, and the keys that protect it live in a dedicated key store or vault rather than alongside the ciphertext. This separation means compromising the database alone does not expose the plaintext secrets.

Question 5Secret Server Fundamentals and Vaulting

What is a folder in Secret Server primarily used for?

  1. Storing the encryption key backup file
  2. Defining the SMTP server used for notifications
  3. Hosting the distributed engine service
  4. Grouping secrets so permissions and configuration can be managed and inherited together Correct answer.

Explanation

Folders organize secrets hierarchically and let administrators apply access control and settings once for many secrets. Child folders and secrets can inherit those permissions, simplifying administration at scale.

Question 6Secret Server Fundamentals and Vaulting

A user reports they can see a secret's name in search results but cannot open it. What is the most likely explanation?

  1. The user's license has been revoked
  2. The user has list permission but lacks view permission on the secret Correct answer.
  3. The secret's password has expired and RPC is failing
  4. The distributed engine is offline

Explanation

Secret Server separates the ability to see that a secret exists from the ability to read its contents. List permission allows discovery in searches and folder views, while view permission is required to open and reveal the value.

Question 7Secret Server Fundamentals and Vaulting

Which statement describes the role of a launcher in Secret Server?

  1. It rotates the secret after each use
  2. It encrypts the secret with a per-user key
  3. It opens a connection to a target system using the stored credential without displaying the password Correct answer.
  4. It copies the secret into the user's clipboard permanently

Explanation

Launchers use the stored credential to start a session, such as RDP or SSH, so the user gains access without ever seeing the password. This masking is a core benefit of vaulting because it limits exposure of the plaintext.

Question 8Secret Server Fundamentals and Vaulting

What is the main reason an organization vaults privileged credentials in Secret Server instead of a shared spreadsheet?

  1. Vaulting removes the need for any authentication
  2. Vaulting provides centralized access control, auditing, and credential rotation Correct answer.
  3. Spreadsheets cannot store long passwords
  4. Spreadsheets are not searchable by name

Explanation

A vault centralizes who can access which credential, records every access in an audit trail, and supports automated rotation. These controls address the accountability and lifecycle gaps that shared spreadsheets leave open.

Question 9Secret Server Fundamentals and Vaulting

An administrator needs every new secret created in a folder to inherit the folder's permissions automatically. Which setting should be verified?

  1. The folder's secret policy forbids comments
  2. The folder's heartbeat is disabled
  3. The folder's inheritance option is enabled for secrets Correct answer.
  4. The folder's launcher is set to RDP

Explanation

Folder inheritance causes child secrets to take their access control from the parent folder rather than maintaining independent lists. When inheritance is enabled, new secrets in that folder adopt the folder's permissions automatically.

Question 10Secret Server Fundamentals and Vaulting

A secret policy in Secret Server is best described as which of the following?

  1. A network firewall rule protecting the web node
  2. A report listing expired secrets
  3. A reusable set of rules controlling rotation, complexity, and heartbeat behavior applied to secrets Correct answer.
  4. A per-user preference for password length

Explanation

Secret policies bundle settings such as password requirements, rotation intervals, and heartbeat schedules so they can be applied consistently across many secrets. Templates and folders reference policies to avoid configuring each secret individually.

Question 11Secret Server Fundamentals and Vaulting

What does a heartbeat on a secret verify?

  1. That the database backup completed
  2. That the stored credential still authenticates successfully to the target Correct answer.
  3. That the launcher license is still valid
  4. That the secret's owner has logged in recently

Explanation

Heartbeat tests the stored credential against the target system on a schedule to detect changed or expired passwords. A failing heartbeat signals that the vaulted value no longer works and rotation or remediation is needed.

Question 12Secret Server Fundamentals and Vaulting

A security team wants to know who viewed a specific privileged account password and when. Where should they look?

  1. The audit log for that secret Correct answer.
  2. The distributed engine configuration
  3. The user's role membership
  4. The secret's template definition

Explanation

Secret Server records access events such as views, edits, and launches in the audit log, which can be filtered by secret. This provides the accountability trail needed to answer who accessed a credential and when.

Question 13Secret Server Fundamentals and Vaulting

Which Secret Server feature lets a user request time-limited access to a secret they normally cannot view?

  1. Distributed engine
  2. Secret template cloning
  3. Heartbeat
  4. Access request workflow with approval Correct answer.

Explanation

The access request workflow lets users ask for temporary access, which an approver grants for a limited window. This supports least privilege by avoiding standing access to sensitive secrets.

Question 14Secret Server Fundamentals and Vaulting

What is the function of a dependency on a secret in Secret Server?

  1. It determines the folder's inheritance behavior
  2. It links a secret to related accounts on a target system that must change together Correct answer.
  3. It sets the encryption algorithm for the secret
  4. It defines which users may approve access requests

Explanation

Dependencies describe related accounts, such as a service account and its associated database login, so that password changes propagate correctly. RPC uses dependencies to keep linked credentials synchronized during rotation.

Question 15Secret Server Fundamentals and Vaulting

An organization wants Secret Server to change passwords on servers in a network segment that cannot reach the web node directly. What should they deploy?

  1. A second database replica
  2. An additional web node in the same segment
  3. A new secret template
  4. A distributed engine in that segment Correct answer.

Explanation

A distributed engine runs RPC and discovery jobs from a host that has network access to the targets, relaying results back to the platform. Placing an engine in the isolated segment solves the connectivity gap without exposing the web node.

Question 16Secret Server Fundamentals and Vaulting

Which practice best protects the Secret Server encryption keys in a production deployment?

  1. Emailing the key file to administrators for convenience
  2. Backing up the keys separately and storing them in a protected, access-controlled location Correct answer.
  3. Storing the key file on the same volume as the database backups
  4. Embedding the keys in the secret template description

Explanation

Without the encryption keys, backed-up secret data cannot be recovered, so keys must be backed up and protected separately from the data. Keeping them in an access-controlled location prevents both loss and unauthorized decryption.

Question 17Secret Server Fundamentals and Vaulting

A user launches an RDP session to a server through Secret Server. What advantage does this provide over revealing the password and connecting manually?

  1. The user gains domain administrator rights
  2. The target server no longer requires authentication
  3. The password is never displayed to the user and the session can be recorded Correct answer.
  4. The secret is automatically deleted after use

Explanation

Launching through Secret Server injects the credential without revealing it and can capture session activity for auditing. This reduces the risk of credential exposure and improves accountability for privileged sessions.

Question 18Secret Server Fundamentals and Vaulting

What is the purpose of secret templates being marked as active or inactive?

  1. Inactive templates change the encryption key
  2. Inactive templates are hidden from users when creating new secrets Correct answer.
  3. Inactive templates disable auditing for those secrets
  4. Inactive templates delete all secrets built from them

Explanation

Deactivating a template removes it from the selection list for new secret creation while leaving existing secrets intact. Administrators use this to retire templates without destroying data.

Question 19Secret Server Fundamentals and Vaulting

Which permission is required for a user to edit a secret's fields and settings?

  1. View
  2. List
  3. Edit Correct answer.
  4. Owner

Explanation

Edit permission allows a user to modify a secret's contents and configuration, going beyond the read access granted by view. List and view are read-oriented permissions and do not permit changes.

Question 20Secret Server Fundamentals and Vaulting

A team wants secrets for a new application to be created with a standard set of fields and an automatic rotation policy. What is the most efficient configuration?

  1. Create each secret manually and set rotation individually
  2. Disable inheritance on each secret
  3. Create a template bound to a secret policy and use it for all the application's secrets Correct answer.
  4. Place all secrets in the root folder with no policy

Explanation

A template defines the field structure while a secret policy supplies rotation and complexity rules, so binding them gives consistent, repeatable configuration. Creating secrets from that template applies both standards without per-secret effort.

Question 21Secret Server Fundamentals and Vaulting

An auditor asks how Secret Server prevents a help-desk technician from reading the local administrator password on a domain controller. Which mechanism answers this?

  1. The domain controller blocks all RDP sessions
  2. The secret template hides the password field
  3. The technician lacks view permission on that secret, enforced by the access control list Correct answer.
  4. The password is encrypted with the technician's user key

Explanation

Authorization is enforced through the secret's access control list, which grants or denies view permission per user or group. A technician without view permission cannot retrieve the value even if they know the secret exists.

Question 22Secret Server Fundamentals and Vaulting

After a planned domain password change, heartbeat reports failures for many service account secrets. What is the most appropriate first diagnostic step?

  1. Check whether the stored credentials were changed outside Secret Server and whether RPC is configured to update them Correct answer.
  2. Disable auditing to reduce load
  3. Delete the affected secrets and recreate them
  4. Rebuild the Secret Server database

Explanation

Heartbeat failures after an external password change usually mean the vaulted value no longer matches the target. Confirming the change source and whether RPC can reset the credential determines whether rotation or manual correction is needed.

Question 23Secret Server Fundamentals and Vaulting

A security architect must ensure that even a database administrator with full access to the Secret Server database cannot read stored passwords. Which design element is most critical?

  1. Storing encryption keys in a separate, access-controlled key store Correct answer.
  2. Enabling session recording on all launchers
  3. Restricting the database administrator's Secret Server role
  4. Increasing the password length in the secret policy

Explanation

Because secret values are stored as ciphertext, the decisive control is keeping the decryption keys outside the database in a protected key store. A database administrator who lacks key access sees only encrypted data, which is the separation of duties the architect needs.

Question 24Secret Server Fundamentals and Vaulting

An administrator wants new secrets added to a subfolder to follow the parent folder's permissions, but also needs a few secrets in that subfolder to have unique access. What is the correct approach?

  1. Move the unique secrets to the root folder
  2. Leave inheritance enabled and break inheritance only on the specific secrets that need unique access Correct answer.
  3. Grant every user owner permission on the subfolder
  4. Disable inheritance for the entire subfolder

Explanation

Inheritance provides a consistent baseline, and breaking it selectively on individual secrets allows exceptions without disrupting the rest. This keeps administration simple while supporting the few cases that genuinely need different access.

Question 25Secret Server Fundamentals and Vaulting

Why does Secret Server separate the list and view permissions on a secret?

  1. To reduce the number of encryption keys required
  2. To allow launchers to run without credentials
  3. To let users discover and request access to secrets they cannot yet read Correct answer.
  4. To simplify the audit log format

Explanation

Separating list from view supports least privilege: users can see that a secret exists and request access without being able to read the value. This enables workflows such as access requests while keeping sensitive values protected.

Question 26Secret Server Fundamentals and Vaulting

Which Secret Server component stores the encrypted secret data and is typically separated from the web front end in a production deployment?

  1. The SQL Server database Correct answer.
  2. The launcher client
  3. The distributed engine
  4. The session recording service

Explanation

Secret Server persists its encrypted data in a SQL Server database, which holds the secrets, configuration, and audit records. In hardened deployments the database is placed on a separate host from the web nodes so that compromise of one tier does not automatically expose the other. Engines and launchers are execution components, not the data store.

Question 27Secret Server Fundamentals and Vaulting

What does Secret Server's remote password changing feature do?

  1. It resets the Secret Server application account password on a schedule
  2. It re-encrypts the database with a new encryption key on demand
  3. It rotates the credential stored in a secret on the target system and updates the secret with the new value Correct answer.
  4. It forces all users to change their Secret Server login password every 30 days

Explanation

Remote password changing uses a configured engine to connect to the target system, change the account's password there, and then write the new value back into the secret. This keeps the vault and the real system in sync without manual intervention. It targets the credential held in the secret, not application or user login passwords.

Question 28Secret Server Fundamentals and Vaulting

A user has been granted only the 'View' permission on a secret and nothing else. What can that user do?

  1. Edit the secret's fields and change its password
  2. Grant other users access to the same secret
  3. Delete the secret and restore it from the recycle bin
  4. See the secret's value and its fields but not modify them Correct answer.

Explanation

View is a read-level permission: it lets the user open the secret and see its stored values and metadata. Editing, deleting, and managing permissions require higher permissions such as Edit or Owner. This separation is intentional so that read access can be granted broadly without conferring change rights.

Question 29Secret Server Fundamentals and Vaulting

Which Secret Server role is used to grant a user administrative rights over the entire application, including configuration and user management?

  1. Folder Owner
  2. Report Viewer
  3. DoubleLock Approver
  4. Secret Server Administrator Correct answer.

Explanation

The Administrator role is an application-wide role that allows configuration changes, user and group management, and access to administrative settings. Folder Owner and other permissions are scoped to individual secrets or folders, not the whole application. Report Viewer and approver roles grant narrow capabilities rather than full administration.

Question 30Secret Server Fundamentals and Vaulting

What is the purpose of Secret Server's audit log?

  1. To record actions such as secret views, edits, and launches for later review Correct answer.
  2. To store the encrypted backups of the vault database
  3. To define which templates are available to users
  4. To cache user sessions so logins are faster

Explanation

The audit log is an append-only record of activity in the system, capturing who did what to which secret and when, including views, edits, permission changes, and session launches. Auditors and security teams use it to reconstruct access to privileged credentials. It is not a backup mechanism, a session cache, or a template registry.

Question 31Secret Server Fundamentals and Vaulting

What is a 'secret' in Secret Server?

  1. A user account used to log in to the Secret Server web interface
  2. A group of folders organized into a site
  3. A single encrypted record holding a credential and its associated fields, such as a username and password Correct answer.
  4. A network device that performs password changes

Explanation

A secret is the fundamental unit of storage: an encrypted record containing a credential such as a password, along with related fields defined by its template. Users are separate identity objects, and engines are the components that perform password changes. Understanding this distinction is basic to working with the vault.

Question 32Secret Server Fundamentals and Vaulting

Which statement best describes the Secret Server web node in a distributed deployment?

  1. It is only used for offline backup restoration
  2. It stores the encryption keys in memory and never contacts the database
  3. It replaces the need for a database by keeping secrets in local files
  4. It serves the user interface and API and relies on the database and engines to complete work Correct answer.

Explanation

The web node handles user and API requests, rendering the interface and enforcing application logic, while delegating storage to the database and remote actions to engines. It is not a standalone data store. Distributed deployments scale by adding web nodes behind a load balancer.

Question 33Secret Server Fundamentals and Vaulting

An administrator wants to prevent a specific group of users from seeing any secret in a folder while still allowing them to see secrets in a sibling folder. What should the administrator configure?

  1. A secret policy applied only to the sibling folder
  2. Folder permissions on each folder, granting access only where appropriate Correct answer.
  3. A new secret template with hidden fields
  4. A heartbeat schedule on the restricted folder's secrets

Explanation

Access to secrets is governed by permissions on the folder that contains them, so the administrator grants the group access on the sibling folder and withholds it on the restricted folder. Secret policies govern behavior such as rotation, not visibility. Templates define fields but do not by themselves restrict who can read a secret.

Question 34Secret Server Fundamentals and Vaulting

A security team wants every privileged account password to be at least 20 characters and rotated every 15 days, applied consistently across many folders. What is the most maintainable approach?

  1. Setting the requirements in each user's profile
  2. Relying on the target systems' local password policy only
  3. Manually editing each secret whenever the requirement changes
  4. Creating a secret policy with the password and rotation requirements and associating it with the relevant secrets or templates Correct answer.

Explanation

A secret policy centralizes requirements such as password length, complexity, and rotation interval, and can be associated with secrets or templates so the rules apply consistently. Changing the policy updates behavior without editing each secret individually. Local target policies alone cannot enforce vault-side rotation schedules.

Question 35Secret Server Fundamentals and Vaulting

What does a heartbeat failure on a secret typically indicate?

  1. The secret template was deactivated
  2. The stored credential can no longer authenticate to the target system Correct answer.
  3. The user viewing the secret lacks the View permission
  4. The secret's folder permissions were changed

Explanation

A heartbeat tests the stored credential against the target system; a failure means the credential did not authenticate, which can result from an out-of-band password change, a locked or disabled account, or a connectivity problem. It does not report on folder permissions or template status. Investigating heartbeat failures usually starts with the target account state and network reachability.

Question 36Secret Server Fundamentals and Vaulting

A user needs to check out a secret so that only they can use it for a defined period. Which Secret Server capability supports this?

  1. Dependency management
  2. Secret checkout with a required check-in Correct answer.
  3. DoubleLock with two approvers
  4. Session recording

Explanation

Checkout reserves a secret for a single user for a limited time, and the secret becomes unavailable to others until it is checked in or the checkout expires. This prevents simultaneous use of a shared credential. DoubleLock adds an approval step, session recording captures activity, and dependencies describe related objects, but none of these reserve exclusive use.

Question 37Secret Server Fundamentals and Vaulting

An administrator must ensure that secrets created under a parent folder automatically inherit its permissions, while still allowing exceptions on individual child folders. What should be configured?

  1. Move all secrets into the root folder
  2. Apply a secret policy to the parent folder
  3. Enable inheritance on the child folders and break it only where an exception is needed Correct answer.
  4. Disable inheritance everywhere and assign permissions manually to each secret

Explanation

Folder inheritance propagates the parent folder's permissions to child folders, so enabling it gives consistent access by default. When a child folder needs different access, inheritance can be broken there and explicit permissions assigned. This balances standardization with targeted exceptions.

Question 38Secret Server Fundamentals and Vaulting

What is the purpose of a Distributed Engine in Secret Server?

  1. To perform password changes and heartbeats on target systems that the web node cannot reach directly Correct answer.
  2. To authenticate users against Active Directory
  3. To store a replica of the vault database for disaster recovery
  4. To render the web interface for remote users

Explanation

A Distributed Engine runs in a network segment that can reach the target systems, allowing Secret Server to perform remote password changing and heartbeats where direct access from the web node is not possible. This is common for segmented or isolated environments. Engines execute actions; they do not serve the UI, replicate the database, or perform directory authentication.

Question 39Secret Server Fundamentals and Vaulting

A user reports that a secret they previously opened now shows an error when they try to view it, and the folder permissions were recently changed by an administrator. What is the most likely cause?

  1. The database was migrated to a new host
  2. The user's access to the secret was removed when folder permissions changed Correct answer.
  3. The secret's heartbeat schedule was disabled
  4. The secret template was renamed

Explanation

Because access is determined by folder and secret permissions, a recent permission change can remove a user's ability to view a secret even though they saw it before. The symptom appears only for that secret or folder, matching the timing of the change. Heartbeat, template, and database changes would produce different symptoms.

Question 40Secret Server Fundamentals and Vaulting

Which practice best supports the integrity of the Secret Server audit trail?

  1. Storing audit logs in the same folder as the secrets
  2. Disabling auditing for read-only users
  3. Restricting audit log access to authorized personnel and preserving logs Correct answer.
  4. Allowing users to delete their own audit entries

Explanation

Audit integrity depends on limiting who can view or alter audit records and on retaining logs for the required period. Only authorized personnel should have access, and logs should be preserved or exported to a protected location. Allowing deletion or disabling auditing for some users undermines the record's reliability.

Question 41Secret Server Fundamentals and Vaulting

Why would an administrator configure a dependency on a secret?

  1. To schedule heartbeats more frequently
  2. To make the secret inherit permissions from another folder
  3. To record related objects, such as an account on a server, so that password changes and impact can be coordinated Correct answer.
  4. To require two approvers before the secret can be viewed

Explanation

Dependencies model relationships between a secret and other objects, such as a service account used by an application, so administrators can see what depends on a credential before changing it. This helps coordinate password changes and avoid outages. Dependencies do not grant permissions, enforce approvals, or set heartbeat frequency.

Question 42Secret Server Fundamentals and Vaulting

What is the effect of marking a secret template as inactive?

  1. Remote password changing is disabled for the template's secrets
  2. Existing secrets using the template are deleted
  3. The template is hidden from selection when creating new secrets, while existing secrets remain Correct answer.
  4. All secrets using the template lose their permissions

Explanation

Deactivating a template removes it from the list of templates users can choose when creating a new secret, which is useful for retiring a format without disrupting existing data. Secrets already created from that template continue to exist and function. Deactivation does not delete secrets or alter their permissions.

Question 43Secret Server Fundamentals and Vaulting

A user needs to launch a remote session to a server using a stored credential without ever seeing the password. Which Secret Server feature enables this?

  1. Session launcher with remote session management Correct answer.
  2. Heartbeat
  3. Password reveal with audit
  4. Secret checkout

Explanation

Secret Server's session launcher can start RDP, SSH, and other sessions using the stored credential, proxying the connection so the password is never displayed to the user. This reduces exposure of privileged credentials while still allowing the work to be done. Checkout and reveal expose the password, and heartbeat only validates it.

Question 44Secret Server Fundamentals and Vaulting

An organization must ensure that the Secret Server encryption keys are protected even if an attacker obtains a copy of the database backup. Which measure addresses this requirement?

  1. Requiring longer user passwords
  2. Increasing the heartbeat frequency
  3. Enabling verbose audit logging
  4. Storing the encryption keys separately from the database, such as in a supported key management or HSM solution Correct answer.

Explanation

Secret Server encrypts data with keys that must be protected independently of the database; storing them in a hardware security module or a supported external key manager keeps them out of database backups. Without the keys, a stolen backup cannot be decrypted. Logging, heartbeat frequency, and user password length do not protect the data encryption keys.

Question 45Secret Server Fundamentals and Vaulting

An administrator wants a set of new application secrets to be created with a standard template and automatically governed by a rotation policy, but users must not be able to override the policy. How should this be achieved?

  1. Place the secrets in the root folder without permissions
  2. Instruct users to select the policy manually when creating each secret
  3. Assign the policy to the template and restrict who can change templates and policies Correct answer.
  4. Apply the policy only after the secrets are created and audited

Explanation

Associating the policy with the template makes it apply automatically to secrets created from that template, and restricting template and policy administration prevents users from overriding it. This enforces the standard at creation time rather than relying on user discipline. Manual selection or post-hoc application leaves room for error.

Question 46Secret Server Fundamentals and Vaulting

A help-desk technician can see a secret in search results but receives an access error when opening it. Which configuration most likely explains this?

  1. The secret's heartbeat is failing
  2. The secret template is inactive
  3. The technician has View permission but lacks List permission
  4. The technician has List permission on the folder but lacks View permission on the secret Correct answer.

Explanation

List and View are separate permissions: List allows a user to see that a secret exists, while View allows opening it and seeing its value. A user with List but not View can find the secret in search yet cannot read it. Heartbeat and template status do not produce this specific combination of symptoms.

Question 47Secret Server Fundamentals and Vaulting

A security architect wants to limit the blast radius if a web node is compromised. Which design choice best supports that goal?

  1. Separating the web tier, database, and engines across hosts with least-privilege service accounts and network controls Correct answer.
  2. Granting the web node's service account database owner rights
  3. Storing encryption keys on the web node's local disk for fast access
  4. Running the web node, database, and engines on a single host for simplicity

Explanation

Tier separation with least-privilege accounts and network restrictions means a compromise of one component does not automatically yield the data store or keys. Collapsing tiers or granting broad database rights expands what an attacker can reach. Keeping keys off the web node further reduces exposure.

Question 48Secret Server Fundamentals and Vaulting

After an unplanned domain-wide password reset, heartbeats begin failing for many service account secrets. What is the most appropriate first step?

  1. Increase the heartbeat interval to hide the failures
  2. Verify whether the stored credentials match the accounts' current passwords and update them via remote password changing Correct answer.
  3. Disable the audit log to reduce noise
  4. Delete the affected secrets and recreate them

Explanation

Heartbeat failures after an out-of-band reset usually mean the vault holds stale credentials. Confirming the mismatch and using remote password changing or an update to resynchronize the secrets restores validity. Deleting secrets, disabling auditing, or hiding failures does not resolve the underlying credential drift.

Question 49Secret Server Fundamentals and Vaulting

An administrator needs to prove to an auditor that a specific user could not read a privileged credential during a given period, despite the user having broad access elsewhere. What evidence best supports this?

  1. The heartbeat history for the secret
  2. The secret's permission history and audit log showing access grants and views for that secret Correct answer.
  3. The user's Active Directory group membership at the time
  4. The template's field configuration

Explanation

The secret's permission history shows who was granted or denied access over time, and the audit log shows actual views and other actions. Together they demonstrate whether the user could and did read the credential during the period in question. Directory membership, heartbeat history, and template fields do not establish access to a specific secret.

Question 50Secret Server Fundamentals and Vaulting

A Secret Server administrator is designing the vaulting model and wants to understand how secret data is protected at rest on the database server. Which statement correctly describes how Secret Server protects stored secret values?

  1. Secret values are stored as plaintext in the database but hidden from users through folder permissions and role assignments.
  2. Secret values are hashed with a one-way function so that no one, including the application, can recover the original password.
  3. Secret values are encrypted only while a user has the secret open in the browser, then written back to the database in cleartext.
  4. Secret values are encrypted with a secret-specific encryption key, and that key is itself encrypted and stored separately from the database. Correct answer.

Explanation

Secret Server uses layered encryption: each secret's data is encrypted with its own key, and those keys are protected by the server's encryption keys rather than sitting alongside the ciphertext in the database. This separation means a copy of the database alone does not expose the underlying passwords. Permissions and auditing control who can decrypt through the application, but they are not the protection mechanism for data at rest.