What are best practices for storing and rotating credentials?

• A. Store Secrets In A Vault/KMS With Encryption At Rest, Rotate On Schedule Or When Compromise Is Suspected, And Enforce Least Privilege
• B. Store Plaintext In Config Files
• C. Rotate Credentials Only After Compromise
• D. Use Shared Credentials Across Teams

Answer: (A)

Storing and rotating credentials securely hinges on using a dedicated secrets management solution (a vault or cloud KMS) to hold secrets, with encryption at rest and centralized access controls. This keeps credentials out of code and config files, enabling proper auditing and, often, automated rotation. Rotating on a schedule reduces the window of exposure, so even if a secret is compromised, it won’t be usable indefinitely. Rotating when a compromise is suspected provides a rapid response to security incidents, helping contain any damage. Enforcing least privilege ensures that each service or user can access only what it truly needs, minimizing who can use or exfiltrate credentials and reducing the impact of any potential leak. Storing plaintext in config files is risky because those files can be exposed through version control or server access, and relying on rotation only after a breach leaves credentials vulnerable for longer. Using the same credentials across teams makes it hard to revoke access, audit usage, or limit blast radius.