Exam Certified Platform Developer II topic 1 question 336 discussion

Use protected custom settings when: You want to specify which profiles and users can access which secrets. Metadata types don’t offer the granularity of the custom settings hierarchy types, which allow you to specify to which profiles or users the secrets should be available. That’s why it is better to use a custom setting here. https://trailhead.salesforce.com/content/learn/modules/secure-secrets-storage/protect-secrets-using-platform-features

This says custom settings: https://developer.salesforce.com/docs/atlas.en-us.secure_coding_guide.meta/secure_coding_guide/secure_coding_storing_sensitive_data.htm

You want to specify which profiles and users can access which secrets. Metadata types don’t offer the granularity of the custom settings hierarchy types, which allow you to specify to which profiles or users the secrets should be available. That’s why it is better to use a custom setting here. https://trailhead.salesforce.com/content/learn/modules/secure-secrets-storage/protect-secrets-using-platform-features

B. This is because custom metadata fields can be used for secret storage in a similar way to custom settings, but with more advantages(1)(2). For proper secrecy, you can set their visibility to ”Protected” and contain them within a managed package(1)(2). Protected custom metadata API fields are a great choice for storing API keys or other secret keys, for example12. 1: https://trailhead.salesforce.com/content/learn/modules/secure-secrets-storage/protect-secrets-using-platform-features 2: https://developer.salesforce.com/docs/atlas.en-us.secure_coding_guide.meta/secure_coding_guide/secure_coding_storing_sensitive_data.htm

I will retract my previous comment as it was incorrect.

The question is somewhat ambiguous, and it is difficult to decide between option B and C... Both hierarchical custom settings and custom metadata can have different values for each profile or user, but only custom metadata can be updated, so wouldn't 'B' be the correct answer?