CCSP Cloud Application Security Practice Question
A company uses a cloud-based CI/CD pipeline with GitLab. Developers push code to a repository, triggering a build. The security team notices that sensitive API keys are being logged in build output. Which practice best prevents this?
⚠ Common exam trap
Candidates often confuse 'using environment variables' (a secure storage method) with 'preventing secrets from being logged' (a detection and blocking mechanism), leading them to choose Option B even though environment variables do not stop accidental output.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Implement a secrets detection tool in the pipeline
A secrets detection tool (e.g., GitLab Secret Detection, TruffleHog, or Gitleaks) scans code and build output for patterns matching API keys, tokens, or passwords before they are logged or stored. This directly prevents sensitive credentials from appearing in build logs, which is the specific issue described. Unlike other options, it actively identifies and blocks secrets at the point of exposure.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Implement a secrets detection tool in the pipeline
Why this is correct
Automated secrets detection scans for and blocks credentials in build output.
- ✗
Use environment variables in the pipeline configuration
Why it's wrong here
Environment variables help but do not prevent hardcoded keys from being logged if explicitly printed.
- ✗
Use a separate build server
Why it's wrong here
This adds complexity and does not address the logging issue.
- ✗
Encrypt the Git repository
Why it's wrong here
Encryption protects data at rest but does not prevent logging of secrets during builds.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CCSP question from scratch — 964 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.