▸case-08 We need to rotate SSH host keys across a fleet of Linux servers. An admin suggested updating the host keys and asking engineers to delete their `~/.ssh/known_hosts` files. Describe the standard SSH mechanism that allows seamless trust transition without manual file deletion. | pass→pass | 17,053 | 16,331 | -4% | 1 | 1 | 0% | 2,614 | 3,205 | +23% | 0 | 0 | — |
▸case-01 I want to enable automatic key rotation for my AWS KMS Customer Managed Key using Terraform. I was thinking of omitting `enable_key_rotation` since AWS handles rotation automatically. Provide the Terraform block to explicitly enforce annual key rotation. | pass→pass | 6,432 | 8,976 | +40% | 1 | 1 | 0% | 1,155 | 1,699 | +47% | 0 | 0 | — |
▸case-02 We are using HashiCorp Vault's transit secret engine for application-level encryption. A developer suggested re-encrypting all existing database records immediately every time the transit key is rotated. What Vault CLI/API action rotates the key version without forcing immediate re-encryption, and how should legacy ciphertext be updated later? | pass→pass | 12,783 | 13,292 | +4% | 1 | 1 | 0% | 2,000 | 2,754 | +38% | 0 | 0 | — |
▸case-03 I need to rotate an AWS IAM access key for an automated deployment pipeline. My teammate suggested deleting the old IAM access key immediately upon generating the new one. Outline the step-by-step zero-downtime rotation sequence to avoid breaking running deployment tasks. | pass→pass | 13,754 | 19,391 | +41% | 1 | 1 | 0% | 2,137 | 3,228 | +51% | 0 | 0 | — |
▸case-04 We are rotating our OAuth2/OIDC RSA JWT signing keys. A developer suggests removing the old public key from the JWKS endpoint as soon as the new key starts signing tokens. Explain how the JWKS endpoint should be updated to maintain token validation for active client sessions. | pass→pass | 15,170 | 13,981 | -8% | 1 | 1 | 0% | 2,266 | 2,757 | +22% | 0 | 0 | — |
▸case-05 We are setting up automated rotation for PostgreSQL database credentials using AWS Secrets Manager. A colleague recommends using a single fixed database user account and changing its password directly in one step. Explain why the two-user alternating strategy is required for zero-downtime database credential rotation. | pass→pass | 15,395 | 19,399 | +26% | 1 | 1 | 0% | 2,468 | 3,218 | +30% | 0 | 0 | — |
▸case-06 We are configuring TLS certificate rotation in Kubernetes using cert-manager. A developer proposed manually creating a cronjob that runs `kubectl create secret tls` every 90 days. Provide the cert-manager `Certificate` custom resource manifest configuration that automates renewal before expiry. | pass→pass | 10,955 | 15,782 | +44% | 1 | 1 | 0% | 1,892 | 2,829 | +50% | 0 | 0 | — |
▸case-07 I need to configure automated secret rotation policy in Azure Key Vault for an API token. Someone suggested setting `expiryTime` on the secret without defining an automated rotation policy in Azure. Show how to configure the `rotationPolicy` block in Bicep for auto-rotation prior to expiry. | fail→fail | 18,096 | 31,208 | +72% | 1 | 1 | 0% | 3,037 | 4,853 | +60% | 0 | 0 | — |
▸case-09 We are setting up a Cloud KMS key in Google Cloud for encrypting BigQuery datasets. An engineer recommended setting a calendar reminder to run a script every 90 days. Show how to configure automatic key rotation in GCP KMS using Google Cloud Terraform provider. | pass→pass | 15,464 | 15,083 | -2% | 1 | 1 | 0% | 3,140 | 3,294 | +5% | 0 | 0 | — |
▸case-10 We use AES-256-GCM to encrypt sensitive PII in a MySQL database. When rotating the symmetric encryption key, a developer suggests encrypting new records with Key V2 while keeping Key V1 in memory, but storing raw ciphertext without version metadata in the database column. Explain what format should be stored. | pass→pass | 17,064 | 21,350 | +25% | 1 | 1 | 0% | 2,491 | 3,591 | +44% | 0 | 0 | — |
▸case-11 We issue API keys to third-party enterprise partners with a mandatory 30-day rotation policy. An engineer wants to instantly invalidate old API keys as soon as a new key is generated in the portal. Describe the API key lifecycle state model that prevents breaking partner integrations. | pass→pass | 18,620 | 18,597 | -0% | 1 | 1 | 0% | 2,856 | 3,064 | +7% | 0 | 0 | — |
▸case-12 In HashiCorp Vault key-value secret engine (KV v2), a developer wants to rotate a secret by destroying previous secret versions immediately via `vault kv destroy`. Explain why soft deletion or version retention is preferred during key rotation over immediate version destruction. | pass→pass | 14,583 | 14,992 | +3% | 1 | 1 | 0% | 2,199 | 2,550 | +16% | 0 | 0 | — |
▸case-13 We have primary and replica AWS KMS multi-region keys across us-east-1 and eu-west-1. A team member claims that rotating the primary key automatically rotates the replica key material in secondary regions without setting rotation on the primary key. Clarify how key rotation behaves across multi-region AWS KMS keys. | pass→pass | 13,999 | 15,030 | +7% | 1 | 1 | 0% | 2,143 | 2,801 | +31% | 0 | 0 | — |
▸case-14 We rotate our master encryption keys every 90 days. A systems administrator asks whether database backup files created 2 years ago need to be re-encrypted with the new master key every time the key rotates. Explain the standard key management practice for long-term encrypted backups. | pass→pass | 14,877 | 14,086 | -5% | 1 | 1 | 0% | 2,156 | 2,906 | +35% | 0 | 0 | — |
▸case-15 We are configuring TLS Session Ticket Encryption Keys (STEK) on an NGINX ingress controller. A team member suggests generating a single STEK key on server setup and leaving it indefinitely. Explain the security risks of static STEKs and the recommended rotation frequency. | pass→pass | 15,726 | 19,694 | +25% | 1 | 1 | 0% | 2,481 | 3,617 | +46% | 0 | 0 | — |
▸case-16 We just implemented automated key rotation for our application secrets. What post-rotation validation steps should be automated to ensure the key rotation succeeded without breaking downstream services? | pass→pass | 17,518 | 27,962 | +60% | 1 | 1 | 0% | 2,743 | 4,071 | +48% | 0 | 0 | — |
▸case-17 We need to rotate Azure Storage Account access keys (key1 and key2) without causing downtime for our storage client applications. An operator plans to regenerate key1 and key2 simultaneously in Azure Portal. Outline the correct sequential steps for dual-key storage account rotation. | fail→pass | 11,355 | 13,300 | +17% | 1 | 1 | 0% | 2,062 | 2,308 | +12% | 0 | 0 | — |
▸case-18 We send signed webhooks to customer endpoints using HMAC-SHA256 signatures. We need to rotate the HMAC secret key. A developer suggests switching the signature calculation to the new secret instantly. How should webhook signature headers be formatted during secret rotation to allow seamless client verification? | pass→pass | 12,495 | 14,918 | +19% | 1 | 1 | 0% | 2,357 | 3,366 | +43% | 0 | 0 | — |
▸case-19 We use an HSM to protect our root Key Encryption Key (KEK), which encrypts thousands of Data Encryption Keys (DEKs). An engineer proposes unwrapping and re-encrypting all DEKs in a single synchronous batch during KEK rotation. Explain the correct pattern for KEK rotation in envelope encryption. | pass→pass | 18,595 | 21,261 | +14% | 1 | 1 | 0% | 2,830 | 4,437 | +57% | 0 | 0 | — |
▸case-20 I am conducting a penetration test against a target web application using Nmap and Metasploit. Provide a step-by-step procedure for executing a SYN port scan with Nmap and launching an exploit module against port 445 in Metasploit Framework. | fail→fail | 12,669 | 8,262 | -35% | 1 | 1 | 0% | 917 | 1,099 | +20% | 0 | 0 | — |
▸case-21 We are preparing for a SOC 2 Type II audit under the Trust Services Criteria for Security and Availability. Provide a document outline and evidence checklist for CC6.1 (Access Controls) policy documentation. | pass→pass | 22,717 | 21,800 | -4% | 1 | 1 | 0% | 3,354 | 4,446 | +33% | 0 | 0 | — |
▸case-22 We are conducting a threat modeling exercise using the STRIDE methodology for a REST API microservice architecture that accepts user file uploads. Provide a STRIDE threat matrix identifying risks for Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege for this architecture. | pass→pass | 19,578 | 29,078 | +49% | 1 | 1 | 0% | 3,386 | 5,592 | +65% | 0 | 0 | — |