ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
A development team is migrating from hard-coded database passwords in source control to a centralized secrets vault that will inject credentials into containers at runtime. To best limit the window of exposure if the container is compromised, which vault capability should the team require as part of the new solution?
Allowing secrets to be injected via environment variables managed by orchestration scripts
Storing encrypted static passwords that must be rotated manually when compromised
Restricting vault access to a small group of privileged administrators only
Issuing dynamic, time-limited credentials that expire automatically after a short lease
The most effective way to minimize the impact of a container compromise is to ensure that any stolen credential stops working as quickly as possible. A vault that can generate dynamic, short-lived credentials on demand accomplishes this by creating unique, time-bound secrets for each requesting workload. Even if an attacker manages to extract the password from a running container, the credential will automatically expire soon after use, drastically reducing the blast radius. Merely encrypting static secrets, storing them in environment variables, or limiting administrator access does not provide the same level of protection because the credentials remain valid until manually rotated or revoked.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What are dynamic, time-limited credentials?
Open an interactive chat with Bash
How does a secrets vault integrate with containers?
Open an interactive chat with Bash
Why is rotating static secrets manually less secure than dynamic credentials?
Open an interactive chat with Bash
What does 'dynamic credentials' mean in the context of a secrets vault?
Open an interactive chat with Bash
How does a secrets vault differ from hard-coded passwords in source control?
Open an interactive chat with Bash
What is the significance of 'short-lived credentials' and how do they work?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)