Question: Which of the following is NOT a way to keep your access token safe?
- Rotate your access tokens every six months
- Store access tokens in an .env file
- Keep your access tokens in a GitHub repository
- Routinely check call logs for any suspicious activity
Explanation
Keeping access tokens in a code repository is unsafe because repositories can be shared, cloned, or exposed. Access tokens should be stored in environment variables or secure secret storage instead of source code. Token rotation helps reduce risk if a token may have been exposed. Reviewing API call logs can help identify suspicious activity tied to a private app. Secure token handling protects account data and prevents unauthorized API access.
Why the other options are incorrect
Rotate access tokens This is a valid safety practice because regular rotation reduces the impact of exposed credentials.
Store in an .env file This is a valid safety practice when the file is kept out of source control.
Check call logs This is a valid safety practice because logs can reveal suspicious or unexpected API activity.
Source for verification
https://developers.hubspot.com/docs/apps/legacy-apps/private-apps/overview
https://developers.hubspot.com/docs/cms/reference/react/local-development
The answer(s) to the question is highlighted in the BOLD text above. You can also find more questions and answers related to the exams on the "Integrating With HubSpot I: Foundations" page.