8. Identify Application Security Issues Related to Secret Protection, Encryption (storage and Transport), and Data Handling 200-901 Practice Questions (Page 5)

Questions 21–25

1. 21application · medium

   A team uses a configuration management tool to deploy network device configurations. The tool stores credentials in a plaintext file in a shared network drive. What is the best improvement?

   • AMove the credentials to a secrets management service and reference them in the tool
   • BUse a different file name that is less obvious
   • CEncrypt the file with a password and share the password via email
   • DChange the file permissions to read-only for all users
   Reveal Solution Discussion Select an answer first
2. 22expert · hard

   A security audit reveals that a network device's enable secret is stored in a configuration file that is backed up to a central server. The backup server is not encrypted. What is the best remediation?

   • AStore the backup server in a locked room
   • BRemove the enable secret from the configuration file and rely on local authentication
   • CChange the enable secret to a stronger password
   • DEncrypt the backup server and use a secrets manager for the enable secret
   Reveal Solution Discussion Select an answer first
4. 23expert · hard

   A DevOps team is building a CI/CD pipeline that deploys network configurations. The pipeline needs to authenticate to a network device using a shared secret. The team wants to avoid storing the secret in the pipeline configuration. Which approach best balances security and operational efficiency?

   • AUse a shared service account with a long-lived password and rotate it quarterly
   • BStore the secret in a file in the repository and restrict access to the repo
   • CUse a secrets manager integrated with the CI/CD tool to inject the secret at runtime
   • DHardcode the secret in the pipeline script and use HTTPS for the connection
   Reveal Solution Discussion Select an answer first
5. 24application · medium

   An application collects user email addresses for account creation, but the product team also wants to store the user's IP address for analytics. The privacy team says to minimize data collection. What should the developer do?

   • AStore the IP address but encrypt it at rest.
   • BStore only the email address and derive analytics from anonymized aggregates.
   • CHash the IP address before storing it.
   • DStore both fields but restrict access to the IP address column.
   Reveal Solution Discussion Select an answer first
6. 25expert · hard

   A company has a legacy application that only supports plaintext HTTP. The application is being migrated to a new data center. The security team requires that all data be encrypted in transit, but the application cannot be modified. Which solution is most appropriate?

   • AUse a site-to-site VPN between the client and the application.
   • BEncrypt the application's configuration file to protect the data.
   • CPlace a TLS-terminating reverse proxy in front of the application.
   • DUse a network sniffer to verify that no sensitive data is sent.
   Reveal Solution Discussion Select an answer first