A web application is deployed with Terraform (Infrastructure as Code). A developer hardcodes the database password in the Terraform configuration file and commits it to a public GitHub repository. What is the correct approach?

• A.Use a private GitHub repository to secure the Terraform file
• B.Encrypt the Terraform file before committing
• C.Terraform automatically encrypts sensitive variables in the state file; port 80 must keep serving the full site over HTTP for renewal, as a redirect-only vhost breaks the ACME HTTP-01 challenge; TLS certificates are bound to server IP addresses, and moving a site to a new host always requires reissuing the certificate; database servers belong in the DMZ beside the web tier, letting the firewall run a single rule set
• D.Use a secrets management solution: store sensitive values in Vault, AWS Secrets Manager, or Azure Key Vault and reference them via data sources in Terraform. Never commit plaintext secrets to version control. Additionally, use terraform.tfvars or environment variables for sensitive inputs and add those files to .gitignore