Mid-LevelCI/CD & DevOps for QA
Describe your approach to managing secrets in CI/CD pipelines.
- secrets management
- security
- CI configuration
Answer it first, then compare. Nothing here is saved or scored.
Model answer
Principles: (1) Never hardcode secrets in code or CI config. (2) Use CI platform secret management (GitHub Secrets, GitLab CI Variables). (3) Rotate secrets regularly and after team member departures. (4) Least privilege: each pipeline step only accesses secrets it needs. (5) Audit: log secret access (not values). (6) For production: use a vault (HashiCorp Vault, AWS Secrets Manager). (7) Test environments should use different secrets than production. (8) Secret scanning in CI to catch accidental commits (pre-commit hooks, CI checks).
What interviewers listen for
- Pipeline shapeYou design stages by failure cost and runtime budget, not by tool feature lists.
- Parallelisation craftYou can shard a real suite and explain the state-isolation choices you made.
- Quality gatesYou know which checks block merge, which warn, and why those defaults are correct.
- Shift-left fluencyYou talk about ownership transfer, not just earlier execution.