# Secure properties across deployment environments

*MuleSoft Developer II Study Guide · Secure data at rest and in transit · Last updated November 7, 2026 · https://www.certifyforce.com/study-guide/mulesoft-developer-ii/secure-data-at-rest-and-in-transit/secure-properties-across-deployment-environments*

Configure encrypted environment files, match their cryptographic settings, and distinguish decryption from worker-based CloudHub property hiding.

- Certification: Salesforce MuleSoft Developer II
- Exam section: Secure data at rest and in transit
- Study guide: https://www.certifyforce.com/study-guide/mulesoft-developer-ii

**Official exam objective:**

> Implement secure, environment-dependent properties management.

## What the exam expects

- Choose property-value encryption or complete-file encryption from the supplied artifact.
- Match each secure-properties configuration to its file and encryption settings.
- Resolve environment selection and dependent properties without circular bootstrap dependencies.
- Distinguish encrypted configuration files from worker-based CloudHub hiding and overrides.

Key terms: **ciphertext** is encrypted data; an **IV** initializes a cipher operation; a **secure placeholder** resolves through the secure-properties provider; a **hidden property** conceals a deployed value in Runtime Manager.

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Supported files | YAML and Spring-formatted properties are supported. | [Secure properties](https://docs.mulesoft.com/mule-runtime/4.6/secure-configuration-properties) |
| Scalar representation | Keep `![ciphertext]`; quote it in YAML. | [Secure properties](https://docs.mulesoft.com/mule-runtime/4.6/secure-configuration-properties) |
| Whole-file switch | True describes an encrypted document; false is the default. | [Secure properties](https://docs.mulesoft.com/mule-runtime/4.6/secure-configuration-properties) |
| Encryption child | Required even when using encryption defaults. | [Secure properties](https://docs.mulesoft.com/mule-runtime/4.6/secure-configuration-properties) |
| IV agreement | Random-IV decryption expects the prepended IV convention. | [Secure properties](https://docs.mulesoft.com/mule-runtime/4.6/secure-configuration-properties) |
| Multiple files | Each secure configuration has its own cryptographic settings. | [Secure properties](https://docs.mulesoft.com/mule-runtime/4.6/secure-configuration-properties) |
| Composition | Secure properties can depend on earlier secure properties. | [Secure properties](https://docs.mulesoft.com/mule-runtime/4.6/secure-configuration-properties) |
| Worker override | Enter the override as clear text and preserve hiding. | [CloudHub properties](https://docs.mulesoft.com/cloudhub/secure-application-properties) |

## Check yourself

- Why does encrypting a properties file leave host access relevant?
- When the reviewer needs evidence that a connector can read its secure properties and connect, which Studio check applies?
- When reviewing secure-property host protection, which console-access boundary also needs restricting?

## Sources

- [Secure Configuration Properties, Mule 4.6](https://docs.mulesoft.com/mule-runtime/4.6/secure-configuration-properties)
- [Safely Hide Application Properties](https://docs.mulesoft.com/cloudhub/secure-application-properties)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 11 linked practice questions, and unlimited timed mock exams are included with the MuleSoft Developer II pack (USD $19): https://www.certifyforce.com/practice-exams