In the provided Python script, database credentials (DB_USER, DB_PWD) are stored in a JSON configuration file (config.json). While it is common to store configuration and credentials in external files, they should always be encrypted to ensure security.
Secret Management: Storing secrets such as database credentials directly in configuration files in plaintext is a security risk.
Encryption: Secrets must be encrypted to protect them from unauthorized access. This can be achieved using various methods such as encrypting the configuration file itself or using secret management tools.
Best Practices: Always ensure that sensitive information like passwords is encrypted when stored, especially in files that might be part of the source code.
Option C is the correct answer because it emphasizes the necessity of encrypting secrets if they are stored in the user database or configuration files to prevent unauthorized access.
Reference:
Cisco DevNet Documentation: Secure Coding Practices