easyMultiple ChoiceObjective-mapped
200-901 Practice Question: A Python script used for network automation…
A Python script used for network automation requires storing an API secret. Which approach is the most secure and recommended best practice?
⚠ Common exam trap
Cisco often tests the misconception that encryption within the script is sufficient, but the trap is that the decryption key must still be stored somewhere, creating a key management problem that environment variables solve by keeping secrets out of the code entirely.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use environment variables
Storing secrets in environment variables decouples sensitive data from the source code, preventing accidental exposure in version control systems like Git. This approach follows the principle of least privilege and is recommended by security best practices such as the Twelve-Factor App methodology. Environment variables are managed outside the script, reducing the risk of credential leakage during code sharing or deployment.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Hardcode the secret in the Python script
Why it's wrong here
Hardcoding exposes secrets in version control and is insecure.
- ✗
Store the secret in a plain text file in the repository
Why it's wrong here
Plain text files in repos are insecure and can be accidentally committed.
- ✗
Encrypt the secret and store it in the script
Why it's wrong here
Encryption keys still need to be stored somewhere, and decryption at runtime adds complexity without clear benefit over env vars.
- ✓
Use environment variables
Why this is correct
Environment variables keep secrets out of code and are configurable per deployment.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.