easyMultiple SelectObjective-mapped
200-901 Practice Question: Which TWO of the following are best practices for…
Which TWO of the following are best practices for securely managing API tokens in a CI/CD pipeline?
⚠ Common exam trap
Cisco often tests the misconception that encrypting secrets with a key stored in the same repository is secure, but the trap here is that encryption without separate key management is equivalent to obfuscation—attackers with repo access can decrypt the token using the stored key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use environment variables injected by the CI/CD system (e.g., Jenkins secrets).
CI/CD systems like Jenkins provide built-in secret management features (e.g., Jenkins Credentials Binding plugin) that inject API tokens as environment variables at runtime, keeping them out of source code and build artifacts. This approach ensures tokens are never stored in plain text or committed to version control, aligning with the principle of least privilege and secure pipeline design.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Store tokens as plain text in the source code repository for easy access.
Why it's wrong here
Storing tokens in plain text in source code is insecure; anyone with access to the repo can read them.
- ✗
Hardcode tokens into the Docker image during build.
Why it's wrong here
Hardcoding tokens in Docker images exposes them to anyone with image access and complicates rotation.
- ✓
Use environment variables injected by the CI/CD system (e.g., Jenkins secrets).
Why this is correct
CI/CD systems can securely inject tokens as environment variables without storing them in code.
- ✗
Encrypt tokens with a static key stored in the repository.
Why it's wrong here
If the static key is in the repository, it is not truly secure; anyone with repo access can reverse the encryption.
- ✓
Use a secrets management service like HashiCorp Vault to retrieve tokens at runtime.
Why this is correct
Secrets management services provide secure storage, access control, and audit logging for tokens.
Go deeper
Related to this question
About these practice questions
Courseiva writes every 200-901 question from scratch — 989 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This 200-901 practice question is part of Courseiva's free Cisco certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the 200-901 exam.