A company uses one provider credential everywhere: developers copy it onto their laptops, the continuous integration system holds it as a build secret, and the production service runs with it. Security states that a credential exposed from a laptop or printed into a build log must not be usable against production workloads or production data. Which arrangement meets that stated requirement?
- AKeep the single credential and rotate it on a weekly schedule, asking developers to update their laptops and the build system after each rotation completes.
- BKeep the single credential and place the production service on a private network segment that developer laptops cannot reach, so an exposed copy has no route to production.
- CIssue a distinct credential per environment, each scoped to that environment's own workload and data, so a development or build credential carries no access to production at all. Correct
- DStore the single credential in a secrets manager and grant developers and the build system read access, so the value is fetched at run time rather than written to disk.
Why A is wrong: Tempting because rotation limits how long a disclosed copy stays valid, but during every window the same credential still reaches production, and manual redistribution to laptops increases the number of places the value is written.
Why B is wrong: Tempting because network segmentation is a real control for internal services, but the provider endpoint the credential authenticates against is reachable from anywhere, so a leaked copy still buys production-level access regardless of where the service itself runs.
Why C is correct: Correct: scoping by environment means the credentials most likely to be exposed are the ones with the least authority, and an exposure on a laptop or in a build log can be revoked without touching the production service.
Why D is wrong: Tempting because central storage removes copies from files and shell profiles, but anyone able to read the value still holds a production credential, and a build log that prints it discloses production access exactly as before.