Exam 350-901 topic 1 question 256 discussion

the answer should be B.

The appropriate secret storage approach depends on the specific use case and the security requirements of the application. However, in general, it is recommended to use an external secret vault to store sensitive data such as API keys and passwords. This approach provides a secure way of storing secrets by encrypting them before storing them on disk. The vault can be accessed by applications to retrieve the secrets when required. Option A is not recommended as it requires setting the API key as an environment variable which can be accessed by other applications running on the same machine. Option C is also not recommended as it requires hardcoding the API key in the code which can be easily accessed by anyone with access to the code. Option D is better than option A and C but still requires embedding the vault key in the code which can be accessed by anyone with access to the code. Option B is recommended as it provides a secure way of storing secrets by encrypting them before storing them on disk. The vault key can be set as an environment variable before running the code and can be accessed by the application to retrieve the secrets when required.

B is the most secure, A is also an option but not the most secure in this way.

Anwser should B as D is incorrect: D. Leverage an external secret vault and embed the vault key as a new variable: Embedding the vault key as a new variable in the code can be a security risk, as it reintroduces the possibility of exposing sensitive information. It is generally preferable to keep the vault key separate from the application code.

I go for D. Vaulting is the safest and it's nonsense to place it in an env variable