HashiCorp Vault Associate (003) Question 120
Single answer5 Secrets enginesA platform team is migrating application secrets into Vault. For one legacy application, the team wants to store a static API token and allow operators to update it manually when the external service rotates the token. They also want version history so they can recover a previous value if a bad token is written by mistake. Which Vault secrets engine should they use for this requirement?
- A
Enable the KV v2 secrets engine and store the API token there
- B
Enable the database secrets engine and create a role for the API token
- C
Enable the transit secrets engine and use it to store the API token securely
- D
Enable the PKI secrets engine and issue a certificate in place of the API token
Show answer and explanation
Correct answer: A
Explanation
The best choice is the KV v2 secrets engine because the scenario is about storing a static secret that humans update manually and that needs version history for rollback. In Vault, KV is the general-purpose secrets engine for key/value data, and version 2 specifically adds versioning and soft delete features that support recovery from accidental writes. By contrast, the database secrets engine is for database credentials, transit is for cryptographic operations without acting as a general secret store, and PKI is for certificate issuance and management. HashiCorp documentation and Vault best practices consistently position KV v2 as the standard engine for static application secrets that need controlled updates and auditability through versioned writes.
- A. Correct.
Correct. The KV v2 secrets engine is designed for storing arbitrary static secrets such as API keys, passwords, and configuration values. KV v2 adds versioning, which allows teams to retain multiple versions of a secret and recover from accidental overwrites or bad updates. This directly matches the requirement for manual updates plus version history.
- B. Incorrect.
Incorrect. The database secrets engine is used to generate dynamic database credentials or manage database-related secrets through supported database plugins. It is not intended to store an arbitrary third-party API token. A common misconception is that any credential should go into the database engine, but this engine is specific to database use cases.
- C. Incorrect.
Incorrect. The transit secrets engine does not store secrets for later retrieval in the way KV does. Transit provides cryptographic operations such as encryption, decryption, signing, and key derivation while keeping encryption keys in Vault. Someone might choose this option because transit is security-related, but it is for cryptographic services, not secret storage with version retrieval.
- D. Incorrect.
Incorrect. The PKI secrets engine is used to generate and manage certificates and certificate authorities. It does not store or version a static API token. This distractor reflects the misconception that any authentication-related material belongs in PKI, when PKI is specifically for X.509 certificate workflows.