Exam 200-901 topic 1 question 93 discussion

Actual exam question from Cisco's 200-901

Question #: 93
Topic #: 1

A developer creates a web application that receives a username and password and uses them to sync the credentials to other services through HTTPS. API keys to services are part of the configuration files of the application, but the credentials to the database that stores the synchronization logs are obtained through an external vault service. What is the security issue in this scenario?

A. Communication between the application and the services is not encrypted.
B. The database credentials should be stored in the configuration files so that they are secured on the same server.
C. The API keys are stored in the configuration files but should be stored in the vault service.
D. The synchronization logs should be encrypted and not stored in a relational database.

Show Suggested Answer

Suggested Answer: C 🗳️

by lukaszggg at April 26, 2022, 12:45 p.m.

Comments

Submit Cancel

bendoyle52

Highly Voted 1 year, 9 months ago

Selected Answer: C

C is the answer

upvoted 6 times

...

adxlp

Highly Voted 1 year, 4 months ago

Selected Answer: C

The answer must be C. The scenario specifically mentions that the communication is done over HTTPS, which provides encryption during transit. Therefore, it is not the primary security issue in this scenario.

upvoted 5 times

...

louisvuitton12

Most Recent 10 months, 1 week ago

Selected Answer: A

A. User ---HTTPS--- > Application ----NOT Encrypted-----> Vault Services

upvoted 1 times

...

penelop

1 year, 10 months ago

It is C. The main big issue here is that the API key are in the config files, hence they are in plain text. If the system is compromised the key is readeable. Now, A is not a concern because usually internal apps communicate through plain HTTP. Think it this way when you are at home you are not as vigilant of your surroundings as when you are in the streets. Same here, we have the app that communicates with external clients, that is encripted, but for internal services it is not encripted (As far as we know). HTTPS is encription in transit, to avoid snooping or MITM, but if someone is inside your house (or your infrastrcuture) your worries are not snooping, they already have access!!

upvoted 2 times

...

concepcionz

2 years ago

Selected Answer: C

I'll go with C because it mentions HTTPS

upvoted 3 times

...

aplicacion101

2 years, 2 months ago

Selected Answer: C

Correct answer is C API keys to services are part of the configuration files of the application. This is de problem. API KEY should be used to safely environment values, that is the better recomendation

upvoted 4 times

...

liqucika

2 years, 3 months ago

Selected Answer: C

C seems to be the most correct since HTTPS is mentioned

upvoted 2 times

...

ghrrman54

2 years, 4 months ago

Selected Answer: A

This is a very tricky question. There are two main parts: 1. Talks about the credentials that the app receives from the external vault service. 2. It later uses these same credentials to sync via HTTPS to other services. We don't know if step 1 is also encrypted with TLS (HTTPS). If you really dig into it, it is indeed A.

upvoted 2 times