SY0-701 Question 488
Single answerDevelopmentA software development team is building a customer-facing web application. During a security review, the team discovers that developers have been hardcoding database credentials into the application source code and committing them to the shared repository. The organization wants to reduce the risk of credential exposure while improving the security of the development process without significantly slowing releases. Which of the following is the BEST solution?
- A
Implement a secrets management solution and modify the application to retrieve credentials securely at runtime
- B
Encrypt the source code repository so developers can continue storing credentials in the code safely
- C
Require developers to store credentials in local configuration files on their workstations instead of the repository
- D
Move the credentials into code comments so they are easier to locate and rotate during deployments
Show answer and explanation
Correct answer: A
Explanation
The best answer is to implement a secrets management solution and have the application retrieve credentials securely at runtime. In secure software development, hardcoded secrets are a well-known risk because they can be exposed through source control, backups, CI/CD logs, and developer workstations. Industry best practices from secure coding guidance, including OWASP recommendations on secrets management and general secure SDLC principles, emphasize removing secrets from code, centralizing their storage, limiting access based on role, and rotating them regularly. This approach also supports practical development needs because it can be integrated into CI/CD pipelines and applications without requiring developers to manually handle sensitive credentials in unsafe ways.
- A. Correct.
Correct. Using a secrets management solution is the most effective approach because it removes embedded credentials from the codebase and supports secure retrieval at runtime. This aligns with secure development and DevSecOps practices by reducing the chance of accidental disclosure in source control, supporting credential rotation, and enabling centralized access control and auditing. This is a common best practice for protecting sensitive information in development pipelines and production environments.
- B. Incorrect.
Incorrect. Encrypting the repository may provide some protection for data at rest, but it does not solve the core problem of storing secrets directly in source code. Developers, build systems, and others with repository access could still retrieve the credentials. It also does not provide proper secret rotation, fine-grained access control, or runtime secret injection. A candidate might choose this option because encryption sounds protective, but it addresses the wrong layer of the problem.
- C. Incorrect.
Incorrect. Moving credentials to local configuration files is better than committing them to source control, but it is still not the best solution. This approach creates inconsistent handling across developer systems, increases the risk of exposure on endpoints, and makes centralized rotation and auditing difficult. Someone might select this because externalizing configuration is generally good practice, but unmanaged local storage of secrets is still weak compared with a dedicated secrets manager.
- D. Incorrect.
Incorrect. Storing credentials in code comments makes the problem worse, not better. Comments are still part of the source code repository and may be exposed through version history, code review tools, and backups. This option reflects a misunderstanding that easier visibility improves security. In reality, sensitive data should never be embedded in comments or code.