easyMultiple ChoiceObjective-mapped
200-901 Secrets management Practice Question
Which of the following is a best practice for securing API keys in a CI/CD pipeline?
⚠ Common exam trap
Cisco often tests the misconception that sharing via encrypted email is secure, but the trap is that email is inherently insecure due to risk of interception, forwarding, and storage in multiple locations. Environment variables, when used with proper secrets management, are a more secure and audited approach.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use environment variables in build configuration
The best practice for securing API keys in a CI/CD pipeline is to use secrets management tools or environment variables with proper protection. While environment variables can be exposed if not handled carefully, they are more secure than sharing via email, which is susceptible to interception, phishing, and unauthorized access. Among the given choices, using environment variables in build configuration (with appropriate security controls) is the recommended approach. Options A, B, and C are all insecure practices.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Share via email
Why it's wrong here
This is incorrect. Sharing API keys via email, even encrypted, is not a best practice because email can be intercepted, forwarded, or stored insecurely.
- ✗
Hardcode in Dockerfile
Why it's wrong here
Hardcoding in Dockerfile is a security risk because the key becomes part of the image layers and can be extracted.
- ✗
Store them in source code
Why it's wrong here
Storing API keys in source code is insecure because they become exposed in version control history and can be accessed by unauthorized users.
- ✓
Use environment variables in build configuration
Why this is correct
This is correct. Using environment variables in build configuration, when combined with a secrets management service (e.g., Jenkins Credentials, GitHub Secrets), is the recommended way to pass API keys securely in a CI/CD pipeline.
Go deeper
Related to this question
About these practice questions
This 200-901 question is part of Courseiva's 989-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.