Which practice supports secure handling of encryption keys and application secrets in an MIPC environment?

• A. Storing keys in configuration files in plaintext
• B. Embedding keys in source code
• C. Centralized key management and rotation with secret vaults
• D. Encrypting data but not rotating keys

Answer: (C)

Secure handling of encryption keys and application secrets relies on centralized key management and regular rotation using secret vaults. Centralized vaults store secrets securely, enforce strict access controls, and keep an auditable trail of who accessed what and when, so credentials aren’t scattered in plaintext configuration files or embedded in code. They also enable automated key and secret rotation, revocation, and re-encryption of data across systems, which dramatically reduces risk if a secret is ever exposed and helps meet security and compliance requirements. In an MIPC environment, this approach limits the impact of a potential breach and simplifies incident response, because you can rotate or revoke keys without touching application code and still maintain access for legitimate services. Storing keys in plaintext or in code is risky because it makes secrets easy to leak, and rotating keys without centralized management tends to be inconsistent and hard to enforce, leaving gaps in security.