CCAR-P Governance, Safety, and Risk Management Practice Question
When integrating Anthropic's API with a CI/CD pipeline for automated testing, which security practice is mandatory to avoid credential leakage?
⚠ Common exam trap
Many candidates incorrectly assume storing secrets in code repository environment variables is secure, overlooking the requirement for dedicated dynamic secret management services.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a dedicated secret management service to inject credentials at runtime.
Using a secret management service (like HashiCorp Vault or AWS Secrets Manager) to dynamically inject API keys at build time is the industry standard. Hardcoding keys or storing them in environment variables in a repository is a severe security failure. This approach ensures that secrets are never exposed in logs or version control, maintaining a tight security posture during the automated deployment of AI-powered applications.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Commit the API key to the Git repository, but encrypt it using the repository's encryption feature.
Why it's wrong here
Committing sensitive credentials to a repository, even if encrypted, is discouraged. If the repository is ever misconfigured or cloned incorrectly, the secret could be exposed. Modern best practice favors using a dedicated secret management solution that keeps secrets entirely out of the version control system's history.
- ✓
Use a dedicated secret management service to inject credentials at runtime.
Why this is correct
This method ensures that keys are never stored in the source code or build logs. By fetching the key dynamically at runtime, the application ensures that the credential remains secured within the environment, significantly reducing the risk of accidental exposure or misuse by unauthorized users or malicious actors.
- ✗
Include the API key in the Dockerfile as an ARG so it's available during the build phase.
Why it's wrong here
Including secrets as ARG variables in Dockerfiles is a major security flaw. These values are often captured in the image layers and can be retrieved by anyone with access to the container registry. Secrets should be injected at container startup using environment-aware secrets management tools, not at build time.
- ✗
Store the API key in a plain text file on the CI/CD runner for easy access by all pipelines.
Why it's wrong here
Storing keys in plain text on CI/CD runners is highly insecure. Any user or process with access to the runner can compromise the key. This violates fundamental security principles and exposes the entire organization to unauthorized API usage and potential data exfiltration, making it a critical governance failure.
About these practice questions
One of 262 original CCAR-P practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Anthropic exam blueprint
This CCAR-P practice question is part of Courseiva's free Anthropic certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCAR-P exam.