ITPEC FE Subject B October 2025 Question 20
From the answer group below, select the most appropriate combination of answers to be inserted into A and B in the description.
Company S is a software company that develops web applications. Some of web applications that Company S develops are open-sourced. The web application code is made publicly available in a repository accessible to anyone. These open-source web applications include features that interact with external services using API keys.
One day, an external security researcher reported to Company S’s security team that the code published in the company’s repository contained an API key. Company S immediately made the repository private and deactivated the API key. Upon further investigation, it was found that a developer on the web application development team accidentally hard-coded the API key when testing a new feature, and committed the code to the source code repository. As a result, this allowed unauthorized users to access external services using the API key.
To prevent a recurrence of such an incident, the security team has proposed adding a coding rule that instead of hard-coding the secrets including the API, use environment variables that allow the application code to be accessed dynamically. Additionally, the team suggested A to detect any secrets that might have been missed by this rule before committing code to a publicly accessible repository. Furthermore, to minimize damage in case any secrets still evade detection, he proposed B.
Answer group
Explanation
A: automated secret scanning tools, B: regular rotation of secrets — catch secrets in the code before it is committed, and make any secret that still leaks short-lived.
Blank A asks for a check that finds secrets the environment-variable rule missed, before code is committed to a public repository. Automated secret scanning searches the code for API keys, tokens and passwords, for example as a pre-commit hook or in the CI pipeline, and blocks the commit.
Blank B assumes a secret has already leaked and asks how to limit the damage. Rotating secrets on a regular schedule means a leaked key stops working at the next rotation, which caps how long an attacker can use it.
Answer (c)
Why not others:
- •(a) and (b) — API logs show misuse only after a key has leaked and been used; they detect nothing before the commit
- •(e) and (f) — antivirus finds malware on developers' PCs, not credentials written into source code
- •(d) — multi-factor authentication protects logins to the repository; the leak came from an authorised developer's commit, and MFA does nothing about a key that is already public
Key rule: Match each control to its stage: prevention before the leak (scanning the code), damage limitation after it (short-lived, rotated credentials), detection after use (logs).
Security Scenarios · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.