QuestionQ44

Application Deployment and Security

A developer builds a web application that accepts a username and password and uses them to synchronize credentials with other services over HTTPS. API keys for the services are included in the application's configuration files, while the database credentials for storing synchronization logs are retrieved through an external vault service. What is the security issue in this scenario?

  • A Communication between the application and the services is not encrypted.
  • B The database credentials should be stored in the configuration files so that they are secured on the same server.
  • C The API keys are stored in the configuration files but should be stored in the vault service.
  • D The synchronization logs should be encrypted and not stored in a relational database.
Explanation

API keys are secrets and should be stored in a dedicated vault or secrets-management service rather than embedded in application configuration files. Centralized secret storage limits exposure and supports controlled retrieval and rotation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!