8. Identify Application Security Issues Related to Secret Protection, Encryption (storage and Transport), and Data Handling 200-901 Practice Questions (Page 3)

Questions 11–15

1. 11expert · hard

   A company must store sensitive customer data in a database. The compliance team requires encryption at rest, but the application team is concerned about performance impact on queries. The data is rarely read, but it must be searchable by an exact match on a customer ID. Which approach best balances security and performance?

   • AUse column-level encryption on the customer ID and all sensitive fields.
   • BUse database-level transparent encryption and keep the customer ID column indexed.
   • CStore the data in an encrypted file and load it into memory for queries.
   • DEncrypt the entire database with application-level encryption and store the key in the application code.
   Reveal Solution Discussion Select an answer first
2. 12application · medium

   A developer is writing a script that calls a REST API. The script needs to authenticate with an API key. The script will be run on a shared CI/CD runner. What is the most secure way to provide the API key to the script?

   • AUse a CI/CD secret variable and reference it in the script.
   • BHard-code the API key in the script and restrict access to the repository.
   • CEncrypt the API key with a key that is also stored in the repository.
   • DStore the API key in a plaintext file in the repository and read it at runtime.
   Reveal Solution Discussion Select an answer first
4. 13expert · medium

   A developer discovers that an API key was accidentally committed to a public repository. The key is used by a production application. What is the most urgent action?

   • ARemove the key from the repository and commit the change
   • BRevoke the API key immediately and issue a new one
   • CChange the repository to private
   • DContact the API provider and ask them to ignore the key
   Reveal Solution Discussion Select an answer first
5. 14expert · hard

   A company must share a dataset containing customer records with a third-party analytics firm. The data includes names, email addresses, and purchase history. The legal team requires that the third party cannot identify individual customers. Which data handling technique is most appropriate?

   • AEncrypt the dataset and share the decryption key with the third party.
   • BReplace names with pseudonyms but keep email addresses and purchase history.
   • CRemove direct identifiers and aggregate purchase history by region.
   • DSend the dataset over a secure file transfer protocol.
   Reveal Solution Discussion Select an answer first
6. 15foundation · easy

   Which of the following is a secure communication practice when a web application needs to send data to an external API over the internet?

   • AUse HTTP and rely on the API's firewall to protect the data.
   • BUse HTTPS with a valid TLS certificate for the API endpoint.
   • CUse FTP to transfer the data because it is faster.
   • DSend the data as a query string parameter in a GET request over HTTP.
   Reveal Solution Discussion Select an answer first