nerdexam
Cisco

300-910 · Question #61

A DevOps engineer must build a Docker image to containerize an application. Then the image must be pushed to a repository on Docker Hub in a CI/CD pipeline using GitHub Actions. Which approach securel

The correct answer is B. Store the access token with GitHub encrypted secrets. To securely manage sensitive credentials like Docker Hub access tokens within a GitHub Actions CI/CD pipeline, it is imperative to use the platform's dedicated secure storage mechanism. This prevents exposure of the token in plain text within the repository or pipeline logs.

CI/CD Pipelines

Question

A DevOps engineer must build a Docker image to containerize an application. Then the image must be pushed to a repository on Docker Hub in a CI/CD pipeline using GitHub Actions. Which approach securely encrypts the Docker Hub access token as an environment variable within the CI/CD pipeline?

Options

  • AStore the access token with GitHub environment variables
  • BStore the access token with GitHub encrypted secrets
  • CStore the access token in an environment file in the repository
  • DHard code the access token in the repository with Base64 encoding

How the community answered

(32 responses)
  • A
    6% (2)
  • B
    88% (28)
  • C
    3% (1)
  • D
    3% (1)

Why each option

To securely manage sensitive credentials like Docker Hub access tokens within a GitHub Actions CI/CD pipeline, it is imperative to use the platform's dedicated secure storage mechanism. This prevents exposure of the token in plain text within the repository or pipeline logs.

AStore the access token with GitHub environment variables

GitHub environment variables are generally not encrypted and can be easily exposed in logs or other outputs, making them unsuitable for storing sensitive access tokens securely.

BStore the access token with GitHub encrypted secretsCorrect

GitHub encrypted secrets are specifically designed to store sensitive information like access tokens securely. These secrets are encrypted at rest, not exposed in workflow logs, and are only made available as environment variables to specific jobs or steps within the GitHub Actions workflow, providing a robust and secure method for managing credentials.

CStore the access token in an environment file in the repository

Storing an access token in an environment file directly within the repository, even if in a .env file, exposes it to anyone with access to the repository's history, which is a major security risk.

DHard code the access token in the repository with Base64 encoding

Hardcoding an access token in the repository, especially with only Base64 encoding, is highly insecure because Base64 is an encoding scheme, not an encryption method, making the token easily discoverable and compromised.

Concept tested: GitHub Actions secrets management, CI/CD security

Source: https://docs.github.com/en/actions/security-guides/encrypted-secrets

Topics

#GitHub Actions#CI/CD Security#Secrets Management#Docker Hub

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full 300-910 Practice