CCSP Practice Question: Is a best practice for managing secrets in a…

Which of the following is a best practice for managing secrets in a cloud-native application?

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

Using a cloud secrets manager to retrieve secrets at runtime

Using a cloud secrets manager (e.g., AWS Secrets Manager) allows applications to retrieve secrets dynamically, avoiding hardcoded credentials.

Answer analysis

For each option: why learners choose it and why it is or isn't the right answer here.

✗
Encrypting secrets and storing them in a configuration file
Why it's wrong here
Encrypted files can still be decrypted if keys are compromised.
✗
Storing secrets in environment variables inside container images
Why it's wrong here
Environment variables in images can be extracted.
✗
Hardcoding secrets in the application source code
Why it's wrong here
Hardcoded secrets are easily exposed in version control.
✓
Using a cloud secrets manager to retrieve secrets at runtime
Why this is correct
Secrets managers provide secure, auditable access.

Go deeper