200-901 Application Deployment and Security Practice Question
A developer is writing a CI/CD pipeline using Jenkins Declarative Pipeline. They want to ensure that sensitive credentials (e.g., API keys) are never exposed in console logs. Which two security practices should be implemented? (Choose two.)
⚠ Common exam trap
Cisco often tests the distinction between using the `environment` directive with `credentials()` (which is secure) versus setting environment variables manually (which is not), and the trap here is that candidates may think any environment variable is safe, but only those sourced from Jenkins credentials are masked.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store the API key in a Jenkins 'Secret text' credential and use the withCredentials step in the pipeline.
Jenkins' `withCredentials` step securely binds a 'Secret text' credential to a variable, masking the value in console logs and preventing exposure. This is the standard practice for handling sensitive data in Declarative Pipeline, as it integrates with Jenkins' credential store and automatically redacts the secret from output.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Store the API key in a Jenkins 'Secret text' credential and use the withCredentials step in the pipeline.
Why this is correct
withCredentials masks the secret in logs.
- ✗
Hardcode the API key in the Jenkinsfile and use the sh step to echo it.
Why it's wrong here
Hardcoding and echoing exposes the key in logs.
- ✗
Pass the API key as a command-line argument to the build script.
Why it's wrong here
Command-line arguments may be visible in process listings or logs.
- ✗
Print the API key to the console for debugging.
Why it's wrong here
Printing exposes the secret.
- ✓
Set the API key as an environment variable using the environment directive, referencing a Jenkins credential.
Why this is correct
Using credentials in environment directive masks the value.
Go deeper
Related to this question
About these practice questions
One of 989 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.