SY0-701 Question 155
Single answerInfrastructure as code (IaC)A company uses infrastructure as code (IaC) templates to deploy web applications into its cloud environment. During a recent audit, the security team discovered that several developers had hardcoded cloud access keys and database passwords directly into the IaC templates stored in the shared source code repository. The organization wants to reduce the risk of credential exposure while keeping deployments automated and repeatable. Which action is the MOST appropriate?
- A
Store secrets in a centralized secrets management solution and have the IaC templates reference them at deployment time
- B
Encrypt the entire source code repository with a symmetric key shared among all developers
- C
Move the hardcoded secrets into commented sections of the IaC templates so they are not executed during deployment
- D
Base64-encode the credentials in the IaC templates and restrict repository access to the operations team only
Show answer and explanation
Correct answer: A
Explanation
The most appropriate response is to remove secrets from IaC templates and store them in a dedicated secrets management system, then reference those secrets securely during deployment. In IaC workflows, templates are commonly stored in version control systems, where hardcoded credentials can be exposed through commits, forks, backups, logs, and repository history. Security best practices recommend treating secrets separately from code. This approach improves confidentiality, supports rotation, and reduces the blast radius of repository compromise. Relevant guidance appears across major vendor and industry documentation, including recommendations from AWS, Microsoft Azure, Google Cloud, HashiCorp Terraform, and OWASP to avoid storing plaintext secrets in code repositories and to use purpose-built secret stores or managed identity mechanisms where possible.
- A. Correct.
Correct. A centralized secrets management solution is the best practice for handling credentials used by IaC. Instead of embedding secrets directly in templates, the templates should reference secrets securely at deployment or runtime. This reduces exposure in version control, supports rotation, and improves auditability. This aligns with common security guidance for IaC and cloud deployments, such as using managed secret stores and avoiding plaintext credentials in code.
- B. Incorrect.
Incorrect. Encrypting the entire repository may add a layer of protection at rest, but it does not address the core problem of embedding secrets in source-controlled IaC files. Developers still need access to the repository, and shared symmetric keys create additional key-management risk. The sensitive data would also remain in version history unless removed and rotated.
- C. Incorrect.
Incorrect. Commenting out secrets does not secure them. Comments are still stored in the repository and visible to anyone with access. This option reflects a common misconception that non-executed content is not a security concern. In practice, commented secrets are still exposed and can be harvested from source control.
- D. Incorrect.
Incorrect. Base64 encoding is not encryption and provides no meaningful protection for credentials. Restricting repository access can reduce exposure somewhat, but it is not sufficient when secrets remain embedded in IaC templates. This approach also weakens separation of duties and does not support secure secret rotation or auditing.