ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
During automated provisioning of a containerized microservice, the operations team must supply an external API token that the service uses at runtime. Which practice best satisfies the secure-installation requirement to "securely inject credentials at runtime" while minimizing any chance that the token is written to persistent storage?
Write the token to a read-only volume mounted from a persistent disk snapshot available to the container.
Have the orchestrator pull the token from a secrets vault and inject it as an environment variable held only in container memory at startup.
Bake the token into the container image during the build process and rely on TLS to protect the registry.
Store the base64-encoded token in a Kubernetes ConfigMap that is version-controlled in Git.
Fetching the API token from a dedicated secrets-management vault at container start and passing it to the process as an environment variable that resides only in the container's memory (or an in-memory filesystem) keeps the credential out of the container image, source repository, and node disks. By contrast, embedding the token in the image or committing it to a version-controlled ConfigMap writes the secret into artifacts that are copied, cached, and backed up. Attempting to write the token to a volume mounted read-only either fails outright (because the filesystem rejects writes) or results in the data living only in the container's ephemeral overlay file system, making the approach unreliable and still leaving any pre-populated copy on persistent media.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a secrets-management vault?
Open an interactive chat with Bash
Why is an environment variable considered a secure way to inject credentials?
Open an interactive chat with Bash
What are the risks of baking credentials into a container image?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)