ISC2 Certified Secure Software Lifecycle Professional (CSSLP) Practice Question
Your DevOps team is containerizing a payment API and plans to store the database password as an environment variable inside the Dockerfile. As the security lead, which approach should you recommend to satisfy organizational requirements for secure storage, minimal exposure, and automatic rotation of service credentials?
Configure the container entrypoint to obtain a database password on start-up from a secrets vault that issues dynamic, time-bound credentials.
Commit an encrypted YAML file holding the password to the Git repository and rely on branch protection to control access.
Reference a Kubernetes ConfigMap that contains the plaintext password and mount it into the container at run time.
Store the password in the Dockerfile, but obfuscate it with Base64 encoding and add a comment explaining the encoding.
Retrieving credentials from a dedicated secrets-management vault that supplies dynamic, short-lived database passwords satisfies multiple security objectives. The password is never hard-coded in images or source control, is transmitted only at run time over a secured channel, and can be rotated automatically when it expires. Base64 encoding offers no real protection, storing cleartext in a ConfigMap leaves the secret visible to any user with read access, and keeping credentials in a version-controlled file-even if branch-protected-still risks accidental disclosure and provides no automated rotation.
Ask Bash
Bash is our AI bot, trained to help you pass your exam. AI Generated Content may display inaccurate information, always double-check anything important.
What is a secrets-management vault?
Open an interactive chat with Bash
Why is dynamic, time-bound credentials important for security?
Open an interactive chat with Bash
What are the risks of hard-coding secrets in a Dockerfile or code repositories?
Open an interactive chat with Bash
What is a secrets vault in DevOps and why is it important?
Open an interactive chat with Bash
How does dynamic and time-bound credential issuance enhance security?
Open an interactive chat with Bash
Why is Base64 encoding not considered a secure way to store passwords?
Open an interactive chat with Bash
ISC2 Certified Secure Software Lifecycle Professional (CSSLP)