200-901 Application Deployment and Security Practice Question
A developer needs to ensure that environment variables containing database credentials are not hardcoded in the application code. Which approach is most secure for managing secrets in a CI/CD pipeline?
⚠ Common exam trap
Cisco often tests the misconception that encrypting and committing secrets is secure, but the trap is that any encryption key stored alongside or in the pipeline can be compromised, and the encrypted file remains in version control history forever.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a secrets management tool like Vault to inject secrets during deployment.
Secrets management tools like HashiCorp Vault provide a centralized, encrypted store for sensitive data such as database credentials, and they inject secrets into the CI/CD pipeline at deployment time via secure APIs (e.g., Vault's HTTP API with TLS). This approach avoids storing secrets in version control, eliminates hardcoding, and supports dynamic secrets, rotation, and audit logging, which aligns with security best practices for CI/CD.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt the .env file and commit it.
Why it's wrong here
Committing an encrypted .env file still places the ciphertext and its decryption key within repository reach, and rotation demands re-encryption and recommitment. A dedicated secrets manager injects credentials at runtime. Encryption suits protecting data at rest in storage, not distributing pipeline secrets.
- ✗
Store the credentials in a .env file committed to the repository.
Why it's wrong here
Committing a .env file exposes credentials in plaintext to anyone with repository read access and to full Git history. A secrets manager injects values at runtime instead. This approach would be acceptable only for non-sensitive local defaults, never for database credentials in a shared CI/CD pipeline.
- ✓
Use a secrets management tool like Vault to inject secrets during deployment.
Why this is correct
Vault stores credentials outside the repository and injects them at deploy time, so secrets never appear in source code, pipeline definitions or image layers. This removes hardcoded credentials from the codebase, satisfying the stem's security requirement.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 975 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.