How do you handle the passwords and credentials your bots need to log in to other systems?

What the interviewer is looking for

• This question tests security & governance. Uses credential vaults, least privilege, audit trails, change control and clear ownership for every automation.
• Strong answers: Credential vault or secrets manager, dedicated service accounts with least privilege, rotation and audit logging, never hard-coded.
• Likely follow-up: What happens when the password expires or is rotated?

Another way it may be asked: Your bot needs to log in to the payroll system every night. Where does that password live and who can see it?

A structure to follow: Answer, explain, example, limits

1. Step 1

   Answer

   Give your direct answer in the first sentence so the interviewer knows where you are going.

2. Step 2

   Explain

   Say how it works or why you would do it that way, in plain words before jargon.

3. Step 3

   Example

   Anchor it in something you have actually done or seen, with the detail that shows hands-on experience.

4. Step 4

   Limits

   Say when your approach would not be the right one. It shows judgement.

This is guidance on shape, not a script. Use your own real experience and facts; never invent details to fill a gap. See the STAR guide and answer frameworks.

Common slips

• Reciting a definition without showing you have applied it.
• Using terms you cannot explain if asked a level deeper.
• Claiming experience beyond what you can discuss in detail.

How to practise it

Say the answer in 90 seconds, then answer the follow-up as if it were a new question.

Related questions

• If you were setting up an automation centre of excellence, how would you decide what gets built, who maintains it and how changes are approved?
• How would you decide whether a manual process is a good candidate for automation?
• Tell me about a small script or automation you've built, even just for yourself. What did it do and how did you test it?
• An automation that copies invoices into the finance system fails halfway through a batch. What should happen next?
• When would you use screen-based robotic process automation instead of connecting through an API, and what are the risks?

Browse all questions