ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
During an assessment you find a YAML file with database passwords and API tokens in a shared Git repo. Ops wants to keep configs under version control for deployments, but auditors say plaintext secrets violate least-privilege and data-at-rest rules. Which action best fixes the issue while still allowing configuration versioning?
Move all secrets out of the YAML file into an encrypted secrets vault that the CI/CD pipeline can reference at deploy time, and keep only non-sensitive settings under version control.
Encrypt the passwords with a reversible algorithm, embed them in the YAML file, and document the decryption key location in the repository for administrators.
Convert the YAML file to JSON and store it in a compressed archive before committing it to the repository to obscure the sensitive values.
Leave the full YAML file in the repository but enable branch protection so merges require code review by senior engineers.
Placing plaintext credentials inside version-controlled files exposes them to anyone who can read the repository, violating least privilege and encryption-at-rest requirements. The best mitigation is to pull the secrets out of the file, store them in a dedicated secrets-management vault that encrypts data and enforces access controls, and inject them at deploy time through the CI/CD pipeline. Obscuring the file with compression or encoding is reversible; branch protection only governs writes, not reads; and encrypting values while publishing the decryption key in the same repo nullifies the protection.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a secrets vault in the context of CI/CD pipelines?
Open an interactive chat with Bash
Why does storing plaintext secrets in version control violate least privilege and data-at-rest rules?
Open an interactive chat with Bash
How does the CI/CD pipeline safely reference secrets during deployment?
Open an interactive chat with Bash
What is a secrets vault in software deployment?
Open an interactive chat with Bash
How does a CI/CD pipeline interact with a secrets vault?
Open an interactive chat with Bash
What are plaintext secrets, and why are they a security risk?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)