200-901 Application Deployment and Security Practice Question
Which TWO actions are best practices for managing secrets in a CI/CD pipeline?
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store secrets as environment variables from a .env file not committed to version control
Option B is correct because loading secrets as environment variables from a .env file that is excluded from version control (e.g., via .gitignore) keeps credentials out of the repository history and injects them only at runtime, reducing exposure. Option E is correct because a dedicated secrets manager like HashiCorp Vault centralizes storage, enforces access policies, supports dynamic/short-lived credentials, and provides auditing and encryption, which are core best practices for CI/CD secret handling. Option A is wrong because long-lived static passwords increase the blast radius if leaked and violate rotation and least-privilege principles. Option C is wrong because hardcoding secrets in source code exposes them to anyone with repository access and persists them in build artifacts and history. Option D is wrong because committing secrets to a configuration file in git stores them in plaintext within version control, where they can be cloned, forked, or leaked.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use long-lived static passwords for service accounts
Why it's wrong here
Long-lived static passwords remain valid indefinitely, so any leak grants persistent access and rotation becomes a manual, error-prone task. It is tempting because static service-account credentials are simple to configure once. Short-lived, dynamically issued credentials from a secrets manager satisfy the pipeline's authentication requirement instead.
- ✓
Store secrets as environment variables from a .env file not committed to version control
Why this is correct
Keeping secrets in a .env file excluded from version control prevents credentials entering Git history, while environment variables inject them at runtime without hardcoding. This satisfies the pipeline's need to avoid exposing secrets in source repositories.
- ✗
Hardcode secrets directly in application code for ease of access
Why it's wrong here
Hardcoding secrets in application code exposes them to anyone with repository or image access, and rotation requires a code change and redeploy. The option tempts because it removes external dependency lookups during builds, which is convenient, but that convenience is exactly why secrets belong in a managed vault or CI/CD secret store instead.
- ✗
Store secrets in a configuration file stored in the git repository
Why it's wrong here
Committing secrets to a git-tracked configuration file exposes them to anyone with repository read access and preserves them permanently in commit history, so rotation cannot remediate the leak. It is tempting because config files are the natural place for non-sensitive pipeline settings; a secrets manager or CI/CD secret store is the correct location for credentials.
- ✓
Use a dedicated secrets management tool such as HashiCorp Vault
Why this is correct
A dedicated secrets manager such as HashiCorp Vault centralises storage, access control, auditing and rotation of credentials, and pipelines retrieve secrets at runtime rather than embedding them. This satisfies the best-practise requirement for managing secrets in CI/CD.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 975 original 200-901 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.