mediumMultiple ChoiceObjective-mapped
200-901 Practice Question: A developer is deploying a Python web application…
A developer is deploying a Python web application on Cisco UCS servers using a CI/CD pipeline that runs on Jenkins. The application uses a PostgreSQL database. The security team mandates that all database credentials must be rotated every 30 days. Currently, credentials are stored as plaintext in a configuration file in the application repository. Which approach should the developer take to meet the rotation requirement without storing secrets in the repository?
⚠ Common exam trap
Cisco often tests the distinction between static secret storage (e.g., Jenkins credentials store or ConfigMaps) and dynamic secret generation (e.g., Vault), where the key requirement is automatic rotation without manual intervention.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Integrate with HashiCorp Vault to dynamically generate credentials for each deployment
Integrating with HashiCorp Vault allows the CI/CD pipeline to dynamically generate short-lived database credentials for each deployment, eliminating the need to store secrets in the repository. Vault can be configured to automatically rotate credentials every 30 days (or less) and inject them into the application at runtime via sidecar containers or API calls, meeting the security mandate without manual intervention.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Integrate with HashiCorp Vault to dynamically generate credentials for each deployment
Why this is correct
Vault can generate short-lived credentials and rotate them automatically, meeting the rotation requirement.
- ✗
Set the credentials as environment variables in the Jenkins pipeline and generate a new set every month manually
Why it's wrong here
Manual rotation is error-prone and does not scale; also, environment variables can leak.
- ✗
Store the credentials in Jenkins credentials store and reference them in the pipeline
Why it's wrong here
Jenkins credentials store does not rotate secrets; it only stores them encrypted.
- ✗
Store the credentials in a Kubernetes ConfigMap and update it every 30 days
Why it's wrong here
ConfigMaps are not secure for secrets and do not enforce rotation; they require manual updates.
Go deeper
Related to this question
About these practice questions
One of 989 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.