Which practice best describes credential management in deployment pipelines?

Which practice best describes credential management in deployment pipelines?

• A. Use secret management, encryption; store in vaults or KMS; restrict access and rotate regularly.
• B. Embed credentials in code for quick access during deployment.
• C. Share credentials via email to the team for transparency.
• D. Disable rotation to avoid service disruptions.

Answer: (A)

Credential management in deployment pipelines means treating credentials as sensitive data that must be protected with encryption, centralized storage, strict access controls, and regular rotation. The best practice is to use secret management, encryption; store in vaults or KMS; restrict access and rotate regularly. This approach keeps credentials out of code and configuration files, provides automated safeguards, and gives you audit trails. Secret stores (like Vault or cloud KMS/secret managers) encrypt secrets at rest and in transit, integrate with your CI/CD pipelines to supply credentials to services on demand, and enforce least-privilege access so only the exact components or people that need a secret can access it. Regular rotation minimizes risk: even if a secret is compromised, it won’t be valid for long, and automated rotation reduces manual effort and errors. In contrast, embedding credentials in code exposes them to version control and builds, making unauthorized access or leakage easy to occur. Sharing credentials via email bypasses access controls and auditing, creating a weak link. Disabling rotation keeps credentials static, increasing the window of opportunity for misuse if a secret is exposed.

Credential management in deployment pipelines means treating credentials as sensitive data that must be protected with encryption, centralized storage, strict access controls, and regular rotation. The best practice is to use secret management, encryption; store in vaults or KMS; restrict access and rotate regularly. This approach keeps credentials out of code and configuration files, provides automated safeguards, and gives you audit trails.

Secret stores (like Vault or cloud KMS/secret managers) encrypt secrets at rest and in transit, integrate with your CI/CD pipelines to supply credentials to services on demand, and enforce least-privilege access so only the exact components or people that need a secret can access it. Regular rotation minimizes risk: even if a secret is compromised, it won’t be valid for long, and automated rotation reduces manual effort and errors.

In contrast, embedding credentials in code exposes them to version control and builds, making unauthorized access or leakage easy to occur. Sharing credentials via email bypasses access controls and auditing, creating a weak link. Disabling rotation keeps credentials static, increasing the window of opportunity for misuse if a secret is exposed.