easyMultiple Choice
CAS-004 Practice Question: A web developer is designing an e-commerce…
A web developer is designing an e-commerce application that stores customer payment information. The application runs on a cloud platform and uses a relational database. During a security review, the auditor identifies that the database admin credentials are hardcoded in the application configuration file. The developer must implement a solution that eliminates hardcoded credentials and enables automatic rotation of secrets. Which course of action should the developer take?
⚠ Common exam trap
CAS-005 often tests the misconception that encrypting configuration files or using environment variables is sufficient; the key is centralized secrets management with automatic rotation.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use a secrets management service to store and rotate the credentials dynamically
A secrets management service (e.g., Google Secret Manager, AWS Secrets Manager, Azure Key Vault) stores credentials securely and provides automatic rotation, eliminating hardcoded secrets. The application retrieves secrets at runtime via API, and rotation can be scheduled or triggered.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Replace the database with one that supports certificate-based authentication
Why it's wrong here
Certificate-based authentication replaces the password but still requires storing and rotating a private key or certificate, so hardcoded credentials persist in another form. It suits mutual TLS between services. A managed secrets service with automatic rotation directly eliminates hardcoded credentials and rotates them.
- ✗
Encrypt the configuration file using the application's built-in encryption
Why it's wrong here
Encrypting the configuration file still leaves credentials embedded in the application, so they are not eliminated and cannot be rotated automatically. File-level encryption suits protecting data at rest, such as database files or backups, not managing application secrets with lifecycle rotation.
- ✗
Store the credentials in environment variables and use a scheduled script to change them
Why it's wrong here
Environment variables remove credentials from source code but remain static; the scheduled script must itself hold privileged credentials, creating a new hardcoded secret. This approach suits simple deployments where rotation is manual, not the automatic secret rotation the scenario demands.
- ✓
Use a secrets management service to store and rotate the credentials dynamically
Why this is correct
A secrets management service stores credentials outside the application configuration and injects them at runtime, directly eliminating the hardcoded values the auditor flagged. Its built-in rotation engine can automatically cycle database admin passwords on a schedule, satisfying the automatic rotation requirement without code changes or redeployment.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CAS-005 question from scratch — 973 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This CAS-005 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CAS-005 exam.