The correct option is Command line arguments might be visible to other users and might also appear in logs or audit trails which could reveal the secret.

This is correct because operating systems commonly expose command line arguments through process inspection and these values can be read by other users on the same machine. Continuous integration systems also tend to capture commands and their parameters in job logs and audit trails, which can inadvertently disclose sensitive values. In GitHub Actions, workflow logs and debugging output can include command invocations, and masking only hides known secret values in logs and does not protect what is visible in the process list. A safer pattern is to use the platform secret store, pass secrets via environment variables or files with restricted permissions, or prefer short lived identity tokens rather than static secrets.

Command line tools never capture audit data so sensitive values cannot be recorded is incorrect because many tools and platforms do record command executions in logs and audits. GitHub Actions captures workflow commands and output, and operating systems and shells can retain histories or logs, so sensitive data may be recorded.

Shells and utilities automatically hide secret values that are provided as arguments is incorrect because shells do not automatically conceal arguments and many utilities echo their inputs. Arguments are also visible in the process list, so relying on automatic hiding is unsafe.

It is considered best practice to pass secrets as command line parameters during builds is incorrect because industry guidance recommends avoiding secrets in command line arguments. Use managed secrets, environment variables, or files with appropriate permissions, and prefer federated credentials when possible.

Full AWS Practitioner Certification Question