HashiCorp Vault Associate (003) Question 140
Single answer5d Describe the purpose of secrets enginesA platform team is onboarding a new internal application to HashiCorp Vault. The developers currently store a shared database password in a KV v2 path and manually rotate it every few months. The team wants to reduce operational overhead and improve security by giving each application instance short-lived database credentials that are generated when needed and automatically expire. Which Vault capability best addresses this requirement?
- A
Enable a database secrets engine so Vault can generate dynamic database credentials with leases and TTL-based expiration
- B
Use the Transit secrets engine so the application can encrypt the existing shared database password before storing it
- C
Create a more restrictive ACL policy on the KV v2 path that holds the shared password
- D
Use Vault namespaces to isolate the application's existing static database password from other teams
Show answer and explanation
Correct answer: A
Explanation
The purpose of Vault secrets engines is to provide specialized workflows for handling secrets, including storing static secrets, generating dynamic secrets, and performing cryptographic functions. In this scenario, the requirement is for on-demand, short-lived database credentials, which is a classic use case for the database secrets engine. Vault can connect to a supported database, create credentials dynamically based on configured roles, and attach leases so the credentials expire automatically. This is a core security benefit of secrets engines: they move teams away from shared, long-lived credentials toward just-in-time access with limited lifetime. By contrast, KV is primarily for storing static secrets, Transit is for cryptographic operations, and ACL policies or namespaces do not themselves generate secrets. This aligns with Vault documentation and best practices around dynamic secrets, leases, and reducing credential sprawl.
- A. Correct.
Correct. Secrets engines are the Vault components responsible for storing, generating, or encrypting data. In this scenario, the database secrets engine is the right fit because it can generate dynamic database credentials on demand for supported databases. These credentials are leased and can expire automatically based on TTL settings, which reduces the need for manual rotation of a shared static password and limits credential lifetime.
- B. Incorrect.
Incorrect. The Transit secrets engine provides cryptographic operations such as encryption, decryption, signing, and hashing without storing the underlying plaintext as a secret in the same way as KV. It does not generate database usernames/passwords for clients. Encrypting the existing shared password would not solve the core problem of replacing static credentials with short-lived, automatically expiring ones.
- C. Incorrect.
Incorrect. Tightening ACL policies can reduce who can read the static password, but it does not change the fact that the application still relies on a long-lived shared credential that must be rotated manually. Policies control access; they do not provide dynamic secret generation or credential leasing.
- D. Incorrect.
Incorrect. Namespaces are used for tenancy and administrative isolation in Vault Enterprise. They do not generate secrets or convert a static password into short-lived database credentials. This option addresses organizational separation, not the purpose of a secrets engine.