8. Identify Application Security Issues Related to Secret Protection, Encryption (storage and Transport), and Data Handling 200-901 Practice Questions (Page 8)

Questions 36–40

1. 36application · medium

   A developer accidentally commits a database password to a public GitHub repository. The password is for a production database. What is the first action the developer should take?

   • ARotate the database password immediately.
   • BChange the repository to private and keep the password.
   • CRemove the password from the file and commit the change.
   • DDelete the repository to remove the password from the internet.
   Reveal Solution Discussion Select an answer first
2. 37foundation · easy

   What is the primary purpose of data classification in an application?

   • ATo speed up database queries by indexing data.
   • BTo encrypt all data with the same key.
   • CTo determine the appropriate level of protection required for different types of data.
   • DTo reduce the amount of storage space used by the application.
   Reveal Solution Discussion Select an answer first
4. 38application · easy

   A network automation tool communicates with network devices using SSH. The tool also has a web dashboard that uses HTTPS. Which statement best describes the security posture?

   • AHTTPS is secure, but SSH is not because it uses port 22
   • BNeither protocol provides encryption because they are both application-layer protocols
   • CSSH is secure, but HTTPS is not because it uses certificates
   • DBoth SSH and HTTPS provide encryption in transit, protecting credentials and data
   Reveal Solution Discussion Select an answer first
5. 39expert · hard

   A developer is building a microservice that needs to authenticate to a central authentication service. The microservice runs in a containerized environment. The security team requires that the service account credentials be rotated regularly and not be stored in the container image. Which approach is most appropriate?

   • AUse a secrets management service that injects credentials as environment variables at runtime.
   • BStore the credentials in a file that is copied into the container image at build time.
   • CUse a hard-coded token in the microservice code and rotate it manually.
   • DUse the same credentials for all microservices to simplify rotation.
   Reveal Solution Discussion Select an answer first
6. 40application · medium

   A web application sends sensitive data from a browser to a backend API. The API is accessible over HTTP and HTTPS. A security review finds that the login form submits over HTTP. What is the most effective remediation?

   • AUse a self-signed certificate on the server.
   • BAdd a client-side script that encrypts the password before submission over HTTP.
   • CKeep HTTP for the login page but use HTTPS for the API calls.
   • DEnforce HTTPS for all traffic and redirect HTTP requests to HTTPS.
   Reveal Solution Discussion Select an answer first