In the provided Python script, database credentials (DB_USER, DB_PWD) are stored in a JSON configuration file (config.json). While it is common to store configuration and credentials in external files, they should always be encrypted to ensure security.
* Secret Management: Storing secrets such as database credentials directly in configuration files in plaintext is a security risk.
* Encryption: Secrets must be encrypted to protect them from unauthorized access. This can be achieved using various methods such as encrypting the configuration file itself or using secret management tools.
* Best Practices: Always ensure that sensitive information like passwords is encrypted when stored, especially in files that might be part of the source code.
Option C is the correct answer because it emphasizes the necessity of encrypting secrets if they are stored in the user database or configuration files to prevent unauthorized access.
Reference:
Cisco DevNet Documentation: Secure Coding Practices