hardMultiple ChoiceObjective-mapped
CISSP Practice Question: Develops a SaaS platform that integrates with…
An organization develops a SaaS platform that integrates with multiple third-party services via APIs. The platform handles authentication tokens and user data. A security review reveals that the platform uses hardcoded API keys in the source code. What is the most secure way to manage these secrets in a cloud-native environment?
⚠ Common exam trap
A common mix-up: candidates choose environment variables (Option A) thinking they are secure enough, but the CISSP exam emphasizes that environment variables are not a secure storage solution because they can be leaked through debugging, logging, or container orchestration tools.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Store secrets in a dedicated secrets management service like AWS Secrets Manager or Azure Key Vault.
Dedicated secrets management services like AWS Secrets Manager or Azure Key Vault provide secure storage, automatic rotation, and fine-grained access control for API keys and tokens. They eliminate the risk of hardcoded secrets in source code or configuration files, which is critical in a cloud-native SaaS platform that integrates with multiple third-party services.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use environment variables in the deployment configuration.
Why it's wrong here
Using environment variables for secrets in deployment configurations is insecure because these variables are often accessible to other processes on the same system, can be inadvertently logged in application or system logs, and may persist in memory or process dumps. This broad exposure makes them vulnerable to unauthorized disclosure if the host system or an application running on it is compromised, lacking the granular access control and auditing capabilities essential for robust secret management.
- ✗
Use .gitignore to prevent them from being committed.
Why it's wrong here
While `.gitignore` is effective for preventing secrets from being committed to a version control repository, it offers no security for the secrets themselves on the local development machine or during the deployment process. The secrets still exist in plain text or easily accessible forms within the local environment, posing a significant risk if that environment is compromised. It is a version control exclusion mechanism, not a security control for secret storage or access.
- ✗
Encrypt the secrets and store them in the database.
Why it's wrong here
Encrypting secrets and storing them directly within a database creates a circular dependency and expands the attack surface. A separate, securely managed encryption key is still required, and if the database itself is compromised, or the application accessing it is, both the encrypted secrets and the key could be exposed. This approach fails to adequately separate the secrets from the data store and introduces the complex challenge of protecting the encryption key without a dedicated secrets management solution.
- ✓
Store secrets in a dedicated secrets management service like AWS Secrets Manager or Azure Key Vault.
Why this is correct
Storing secrets in a dedicated secrets management service like AWS Secrets Manager or Azure Key Vault is the most secure and recommended practice. These services provide centralized, highly secure storage, isolating secrets from application code and infrastructure. They offer robust access control mechanisms, comprehensive audit trails, automatic rotation capabilities, and often integrate with hardware security modules (HSMs) for key protection, significantly reducing the attack surface and operational burden of managing sensitive credentials.
Quick reference
AWS S3 Storage Class Comparison
| Storage Class | Min Duration | Retrieval | Use Case |
|---|---|---|---|
| S3 Standard | None | Immediate | Frequently accessed data |
| S3 Standard-IA | 30 days | Immediate | Infrequent access, rapid retrieval |
| S3 One Zone-IA | 30 days | Immediate | Non-critical infrequent data |
| S3 Intelligent-Tiering | None | Immediate–hours | Unknown or changing access patterns |
| S3 Glacier Instant | 90 days | Milliseconds | Archive with instant retrieval |
| S3 Glacier Flexible | 90 days | Minutes–hours | Archive, flexible retrieval |
| S3 Glacier Deep Archive | 180 days | Hours | Long-term compliance archive |
Go deeper
Related to this question
Learn chapter
Security Governance and Principles
Key term
Authentication
Authentication is the process of verifying that someone or something is who or what it claims to be before granting access to a system or resource.
Key term
Security
Security in IT is the practice of protecting systems, networks, and data from unauthorized access, damage, or theft.
About these practice questions
This CISSP question is part of Courseiva's 747-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CISSP practice question is part of Courseiva's free ISC2 certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CISSP exam.