A team is creating an API token for an automation script that reads Instana data. How should the token be handled?
Select an answer to reveal the explanation.
Short Explanation
Treat that token like any other credential: give it only the permissions the script needs, keep it secret, and rotate it on a schedule. Just because a script uses it doesn't make it less dangerous if it leaks.
Full Explanation
The correct approach is to scope the token to the permissions the automation actually needs, store it as a secret, and rotate it on a defined schedule. Narrow scope limits what a leaked token can do, secret storage limits who can obtain it, and rotation limits how long an exposure remains useful.
Displaying the token on a shared dashboard so team members can copy it when needed is incorrect because a token on a dashboard is visible to everyone with dashboard access, including people who should not hold that authority.
Reusing an administrator's personal token so the script is never blocked by a permissions issue is incorrect because a personal administrator token grants the script far more than it needs, ties automation to one individual's account, and makes audit trails misleading.
Issuing the token once with full permissions and leaving it in place indefinitely to avoid breaking the automation is incorrect because an unrotated, over-permissioned token is a standing risk that grows with every place it is copied to.
For the exam, apply least privilege, secret storage, and rotation to API tokens.