CCDV-F - Security and Safety (8.1% of the exam) - Section 7.4
Manage secrets, credentials, and API keys across development and production environments.
Published skill weight 1.6 percent. Covers handling secrets, credentials and API keys across Claude development and production environments, identity validation and authentication, access approval and level verification, and monitoring authorised access after it has been granted.
secrets and credential managementAPI key handlingidentity validationaccess approval and level verificationauthorised access monitoring
Practice question for this objective
lock_openFree sampleSecurity and Safetymedium
A company uses one provider credential everywhere: developers copy it onto their laptops, the continuous integration system holds it as a build secret, and the production service runs with it. Security states that a credential exposed from a laptop or printed into a build log must not be usable against production workloads or production data. Which arrangement meets that stated requirement?
AKeep the single credential and rotate it on a weekly schedule, asking developers to update their laptops and the build system after each rotation completes.
BKeep the single credential and place the production service on a private network segment that developer laptops cannot reach, so an exposed copy has no route to production.
CIssue a distinct credential per environment, each scoped to that environment's own workload and data, so a development or build credential carries no access to production at all.check_circle Correct
DStore the single credential in a secrets manager and grant developers and the build system read access, so the value is fetched at run time rather than written to disk.
Separate credentials by environment so a credential exposed in development or continuous integration carries no production authority. Storage location and rotation cadence change how easily a credential leaks and how long it lives, but not what it can do once disclosed. Distinct per-environment credentials bind authority to the environment that holds them, so the requirement is met by what the exposed credential is permitted to reach rather than by trying to prevent every exposure.
Why A is wrong: Tempting because rotation limits how long a disclosed copy stays valid, but during every window the same credential still reaches production, and manual redistribution to laptops increases the number of places the value is written.
Why B is wrong: Tempting because network segmentation is a real control for internal services, but the provider endpoint the credential authenticates against is reachable from anywhere, so a leaked copy still buys production-level access regardless of where the service itself runs.
Why C is correct: Correct: scoping by environment means the credentials most likely to be exposed are the ones with the least authority, and an exposure on a laptop or in a build log can be revoked without touching the production service.
Why D is wrong: Tempting because central storage removes copies from files and shell profiles, but anyone able to read the value still holds a production credential, and a build log that prints it discloses production access exactly as before.
Answers that look right on this material and are not. Each one is a distractor from a different question in the CCDV-F bank for this domain.
Restrict read access on the tracing backend to the owning team, so the recorded credential is no longer visible to support engineers elsewhere in the company.
errorWhy it is wrong: Tempting because it addresses the wording of the review directly, but the credential is still stored in clear text in a second system for 90 days, and support engineers lose the traces the review said they must keep.
Fetch the provider key once at first launch, hold it in the device's encrypted keychain, read it from there on every later call to the provider, and clear it when the customer signs out of the app.
errorWhy it is wrong: Tempting because keychain storage is the correct place for a value that genuinely belongs on a device, but the credential still lands on hardware the customer controls and can be read from a rooted or jailbroken handset, and replacing it means re-issuing it to every installed device.
Schedule a weekly manual review in which an engineer samples fifty stored conversations, grades them against the quality rubric and raises a ticket when the sampled refusal rate looks unusual.
errorWhy it is wrong: Sampling stored conversations is a genuine quality practice and the team does hold the records, but a weekly cadence cannot detect a shift inside one hour, so it misses the stated requirement by several days.