200-901 Question 122
Select 3You are developing a cloud-based application that interacts with multiple services using API keys. To ensure the security of these secrets, which best practices should you implement?
- A
Store API keys in environment variables instead of hardcoding them in source code.
- B
Encrypt API keys before storing them in configuration files.
- C
Commit API keys to version control systems like Git for easy access.
- D
Use a secrets management tool such as HashiCorp Vault or AWS Secrets Manager.
- E
Share API keys with team members over email for convenience.
Show answer and explanation
Correct answers: A, B, D
Explanation
To ensure the security of application secrets such as API keys, developers must follow best practices like storing secrets in environment variables, encrypting them when stored in files, and utilizing secrets management tools. These methods reduce exposure risks and ensure proper access control. Practices like committing secrets to version control systems or sharing them over email are discouraged due to the high risk of unauthorized access.
- A. Correct.
Storing API keys in environment variables is a security best practice as it avoids embedding sensitive information directly in the source code, reducing the risk of exposure.
- B. Correct.
Encrypting API keys before storing them in configuration files adds an additional layer of protection, ensuring that even if the file is accessed, the keys are not easily readable.
- C. Incorrect.
Committing API keys to version control systems is a poor practice as it exposes secrets to anyone with access to the repository, potentially leading to security breaches.
- D. Correct.
Using a secrets management tool like HashiCorp Vault or AWS Secrets Manager provides a centralized, secure way to manage and access secrets, following industry best practices.
- E. Incorrect.
Sharing API keys over email is insecure as emails can be intercepted or accessed by unauthorized parties, which compromises the security of the secrets.