200-901 · Question #271
A developer creates a web application that receives a username and password and uses them to sync the credentials to other services through HTTPS. API keys to services are part of the configuration…
The correct answer is C. The API keys are stored in the configuration files but should be stored in the vault service. The scenario describes a sound practice for database credentials (stored in a vault) but a security flaw for API keys (stored in configuration files). Configuration files are often checked into source control or included in application packages, making secrets inside them…
Question
A developer creates a web application that receives a username and password and uses them to sync the credentials to other services through HTTPS. API keys to services are part of the configuration files of the application, but the credentials to the database that stores the synchronization logs are obtained through an external vault service. What is the security issue in this scenario?
Options
- ACommunication between the application and the services is not encrypted.
- BThe database credentials should be stored in the configuration files so that they are secured on
- CThe API keys are stored in the configuration files but should be stored in the vault service.
- DThe synchronization logs should be encrypted and not stored in a relational database.
How the community answered
(32 responses)- A6% (2)
- B9% (3)
- C81% (26)
- D3% (1)
Explanation
The scenario describes a sound practice for database credentials (stored in a vault) but a security flaw for API keys (stored in configuration files). Configuration files are often checked into source control or included in application packages, making secrets inside them vulnerable to exposure. All sensitive credentials - including API keys - should be stored in a secrets management solution like a vault service, not in config files. Choice A is wrong because HTTPS is already used. Choice B is wrong because config files are not inherently secure. Choice D is irrelevant to the described security concern.
Topics
Community Discussion
No community discussion yet for this question.