HashiCorp Vault Associate (003) Question 127
Single answer5a Choose a secrets engine based on use caseA platform team is onboarding a new internal application to Vault. The application runs in Kubernetes and needs short-lived PostgreSQL credentials generated on demand for each deployment. The database administrators do not want application teams to know or manage a shared static database password, and they want credentials to expire automatically when no longer needed. Which Vault secrets engine is the best fit for this use case?
- A
KV secrets engine, because it can store the PostgreSQL username and password and version updates over time
- B
Database secrets engine, because it can generate dynamic database credentials with leases and automatic revocation
- C
Transit secrets engine, because it can encrypt the database password so applications never see it in plaintext
- D
PKI secrets engine, because it can issue short-lived certificates that can be used as PostgreSQL usernames and passwords
Show answer and explanation
Correct answer: B
Explanation
The best choice is the Database secrets engine because the requirement is for dynamic, short-lived PostgreSQL credentials that are generated on demand and expire automatically. This is one of Vault's core dynamic secrets use cases. In contrast, the KV secrets engine stores static values, Transit performs cryptographic functions, and PKI issues certificates. HashiCorp Vault documentation describes the database secrets engine as the mechanism for creating dynamic credentials for databases, including PostgreSQL, using roles, leases, and revocation. For exam purposes, a key decision point is matching the use case to the engine: KV for static secret storage, Database for dynamic DB credentials, PKI for certificates, and Transit for encryption/signing operations.
- A. Incorrect.
Incorrect. The KV secrets engine is for storing static secrets such as usernames, passwords, API keys, or configuration values. While KV v2 supports versioning, it does not natively generate database credentials dynamically or manage database users and revocation. A team might choose this if they are thinking only about storing a password securely, but the scenario specifically requires short-lived credentials generated on demand and automatically expiring.
- B. Correct.
Correct. The Database secrets engine is designed for exactly this scenario: generating dynamic credentials for supported databases such as PostgreSQL. Vault can create database users or credentials based on configured roles, attach a lease/TTL, and revoke them when the lease expires or is revoked early. This removes the need for shared static passwords and aligns with least-privilege and short-lived access patterns.
- C. Incorrect.
Incorrect. The Transit secrets engine provides cryptographic operations such as encryption, decryption, signing, and key derivation without storing the plaintext data as a secret. It is not used to generate database accounts or issue leased database credentials. Someone might pick this option because it helps protect sensitive data, but it does not solve the requirement for dynamic PostgreSQL login creation and expiration.
- D. Incorrect.
Incorrect. The PKI secrets engine issues X.509 certificates for TLS and related certificate-based identity use cases. It is not the standard choice for generating PostgreSQL usernames and passwords. Although some databases can integrate with certificates for authentication in certain architectures, the scenario explicitly asks for PostgreSQL credentials generated on demand, which is the Database secrets engine use case.