Which statement about application properties is true?

• A. Credentials should be hard-coded for performance
• B. Credentials are injected at runtime and can be encrypted, defined in .properties files, with environment-specific files
• C. They are stored in XML only
• D. They require an external database to function

Answer: (B)

Application properties are externalized values loaded at runtime and referenced by the app, which lets you inject configuration without hard-coding it and vary it by environment. The statement that credentials are injected at runtime and can be encrypted, defined in .properties files, with environment-specific files is the right approach in MuleSoft. You place non-sensitive values in a .properties file and reference them in your flow with placeholders like ${property.name}. For sensitive data, you can use the Secure Property Placeholder to encrypt those values and decrypt them at runtime, often using a secret or keystore. You can also maintain separate property files for different environments (for example, dev.properties, prod.properties) so the app automatically picks up the right values per deployment, keeping configuration outside the code and secure.

Hard-coding credentials is discouraged because it exposes secrets in source control and deployments, and it undermines portability and security. Storing properties only in XML isn’t accurate for this model, since .properties files are the standard external configuration source referenced by the placeholder mechanism. Requiring an external database isn’t a feature or requirement of application properties themselves; properties are just values, not dependencies on a database.