A county IT team runs the same automation code against lab and production network controllers. How should credentials be handled?
Select an answer to reveal the explanation.
Short Explanation
Lab and prod controllers are different buildings—different keys on different keyrings in the vault. Inject the matching secret for the environment you target. One password in git or prod tokens in lab is how a test script paints the live city.
Full Explanation
County IT running the same automation code against lab and production network controllers must store distinct lab and production secrets in a vault and inject the correct set per environment. Credential separation prevents lab experiments from using production authority and keeps secrets out of repositories. Environment injection is standard secure automation practice.
Hard-coding one shared admin password in the repository for every controller is a critical anti-pattern. Reusing production tokens in lab scripts to keep environments identical risks production impact from lab bugs. Embedding credentials in commit messages for audit visibility exposes secrets permanently.
Exam caveat: also separate endpoints/URLs per environment—secret injection alone is insufficient if code points at production hosts. Operational check: run the job with lab vault credentials against lab controllers, require a manual approval gate before prod secret injection, and scan repos for leaked tokens. Rotate credentials on a civic schedule. Record the chosen control and rejected alternatives in the municipal change record so future on-call engineers understand the failure modes avoided for city services. Re-validate after the next maintenance window that telemetry, API results, and device state still match the documented design intent.