HashiCorp Vault Associate (003) Question 129
Single answer5a Choose a secrets engine based on use caseA company is moving a legacy application into Kubernetes and wants to stop storing long-lived database passwords in configuration files. The application connects to PostgreSQL, and the security team wants each app instance to receive credentials that are created on demand and automatically expire after a short time. Which Vault secrets engine is the best fit for this use case?
- A
KV secrets engine
- B
Transit secrets engine
- C
Database secrets engine
- D
PKI secrets engine
Show answer and explanation
Correct answer: C
Explanation
The best choice is the Database secrets engine because this use case is a classic example of dynamic secrets. Vault can connect to PostgreSQL, use privileged credentials to create short-lived database accounts, lease those credentials to the application, and revoke them when the lease expires or is revoked early. This reduces the operational and security risk of embedded static passwords. By contrast, KV is for static secrets, Transit is for encryption-as-a-service, and PKI is for certificate issuance. HashiCorp Vault documentation and best practices consistently recommend using the Database secrets engine when applications need ephemeral database credentials instead of manually managed static usernames and passwords.
- A. Incorrect.
The KV secrets engine is not the best choice here because it stores static key-value data. While you could place a database username and password in KV, those credentials would be long-lived unless rotated manually or through external automation. The scenario specifically requires credentials to be generated on demand and to expire automatically, which KV does not provide.
- B. Incorrect.
The Transit secrets engine is used for cryptographic operations such as encryption, decryption, signing, and hashing without storing the raw data in Vault. It does not generate PostgreSQL login credentials for applications, so it does not address the need for short-lived database usernames and passwords.
- C. Correct.
The Database secrets engine is correct because it can generate dynamic database credentials for supported databases such as PostgreSQL. Vault creates credentials on demand using configured roles and automatically revokes or lets them expire based on the lease. This matches the requirement to eliminate long-lived passwords in configuration files and provide short-lived, per-instance access.
- D. Incorrect.
The PKI secrets engine issues certificates and is appropriate when clients need X.509 certificates, such as for mTLS or certificate-based authentication. It does not generate standard PostgreSQL username/password credentials, so it is not the best fit for this scenario.