hardMultiple Choice
CCSP Practice Question: A developer accidentally hardcodes AWS access…
A developer accidentally hardcodes AWS access keys in a public GitHub repository. Which tool is specifically designed to detect such secrets in code repositories?
⚠ Common exam trap
ISC2 often tests the distinction between infrastructure-as-code security scanners (Checkov, tfsec) and secret detection tools (GitGuardian), trapping candidates who assume any security tool can find hardcoded credentials.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
GitGuardian
GitGuardian is a purpose-built tool for detecting secrets (e.g., AWS access keys, API tokens) in code repositories, including public GitHub repos. It scans commit history and uses pattern matching to identify hardcoded credentials, alerting developers in real time. This directly addresses the scenario of accidental exposure in a public repository.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Checkov
Why it's wrong here
Checkov scans infrastructure-as-code templates for misconfigurations, so it does not search commit history or files for embedded AWS access keys. It is tempting because it examines code repositories, and would be correct when enforcing policy compliance across Terraform, CloudFormation or Kubernetes manifests during CI pipelines.
- ✓
GitGuardian
Why this is correct
GitGuardian is a dedicated secrets-detection platform that scans repositories and commit history for exposed credentials such as AWS access keys. It directly matches the stem's requirement for a tool specifically designed to find secrets in code repositories.
- ✗
Snyk
Why it's wrong here
Snyk focuses on open-source dependency vulnerabilities and container image issues, not on locating hardcoded credentials within repository files. It is tempting because it integrates with GitHub, and would be correct when identifying vulnerable third-party libraries or base images in a project's dependency tree.
- ✗
tfsec
Why it's wrong here
tfsec statically analyses Terraform configurations for infrastructure misconfigurations, not repository content for hardcoded credentials. It is tempting because it scans code, and would be correct when validating Terraform plans for issues such as unencrypted storage or overly permissive security group rules before deployment.
About these practice questions
One of 934 original CCSP practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CCSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CCSP exam.