200-901 Application Deployment and Security Practice Question
A developer needs to ensure that environment variables containing database credentials are not hardcoded in the application code. Which approach is most secure for managing secrets in a CI/CD pipeline?
⚠ Common exam trap
Cisco often tests the misconception that encrypting and committing secrets is secure, but the trap is that any encryption key stored alongside or in the pipeline can be compromised, and the encrypted file remains in version control history forever.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a secrets management tool like Vault to inject secrets during deployment.
Secrets management tools like HashiCorp Vault provide a centralized, encrypted store for sensitive data such as database credentials, and they inject secrets into the CI/CD pipeline at deployment time via secure APIs (e.g., Vault's HTTP API with TLS). This approach avoids storing secrets in version control, eliminates hardcoding, and supports dynamic secrets, rotation, and audit logging, which aligns with security best practices for CI/CD.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Encrypt the .env file and commit it.
Why it's wrong here
Even encrypted files can be risky if keys are compromised; better to avoid committing secrets altogether.
- ✗
Store the credentials in a .env file committed to the repository.
Why it's wrong here
.env files should not be committed; they expose secrets in version control.
- ✓
Use a secrets management tool like Vault to inject secrets during deployment.
Why this is correct
Vault securely manages secrets and injects them only at runtime.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.