200-901 Application Deployment and Security Practice Question

Which TWO actions are best practices for managing secrets in a CI/CD pipeline?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Store secrets as environment variables from a .env file not committed to version control

Environment variables from .env files not committed, and using a secret vault (like HashiCorp Vault) are recommended. Hardcoding in code, storing in config files in git, and using long-lived passwords are insecure.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Use long-lived static passwords for service accounts
Why it's wrong here
Long-lived passwords increase risk.
✓
Store secrets as environment variables from a .env file not committed to version control
Why this is correct
Keeps secrets out of git.
✗
Hardcode secrets directly in application code for ease of access
Why it's wrong here
Hardcoding is insecure.
✗
Store secrets in a configuration file stored in the git repository
Why it's wrong here
Storing in git exposes secrets.
✓
Use a dedicated secrets management tool such as HashiCorp Vault
Why this is correct
Vault provides secure storage and access control.

Go deeper

200-901 Application Deployment and Security Practice Question

Why each option matters

Option-by-option breakdown

Related to this question