HashiCorp Vault Associate (003) Question 141
Single answer5d Describe the purpose of secrets enginesA platform team is moving several applications to HashiCorp Vault. One application currently stores a long-lived database password in a configuration file, while another needs encryption-as-a-service for small pieces of sensitive application data. The team wants to reduce secret sprawl and use Vault components for these needs. Which statement best describes the purpose of Vault secrets engines in this scenario?
- A
Secrets engines are Vault components that store, generate, or encrypt sensitive data for specific use cases, such as dynamic database credentials or transit encryption operations.
- B
Secrets engines are authentication methods used to verify application identities before they can request Vault tokens.
- C
Secrets engines are policy templates that define which users can read or update secrets across all paths in Vault.
- D
Secrets engines are storage backends that replicate encrypted secret data between Vault clusters in different regions.
Show answer and explanation
Correct answer: A
Explanation
Vault secrets engines are the logical components used to manage secrets for different purposes. Some engines store static secrets in the KV secrets engine, some generate dynamic secrets such as database credentials, and others provide cryptographic services such as the Transit secrets engine. Their purpose is to centralize secret management and reduce risks associated with hardcoded or long-lived credentials. In this scenario, the database secrets engine addresses the problem of static database passwords by issuing dynamic credentials, while the Transit secrets engine addresses encryption-as-a-service needs. This aligns with Vault documentation describing secrets engines as plugins that store, generate, or encrypt data. It is important to distinguish secrets engines from auth methods, which authenticate identities, and from policies, which authorize actions.
- A. Correct.
Correct. Secrets engines are the components in Vault that handle secrets-related operations for specific workflows. Examples include the database secrets engine, which can generate dynamic database credentials, and the Transit secrets engine, which provides encryption, decryption, signing, and related cryptographic operations without requiring applications to manage encryption keys directly. This matches the scenario's goals of replacing static credentials and providing encryption-as-a-service.
- B. Incorrect.
Incorrect. This describes auth methods, not secrets engines. Authentication methods such as AppRole, Kubernetes, LDAP, or userpass verify identity and allow a client to obtain a Vault token. After authentication, the client uses that token to access secrets engines according to policy.
- C. Incorrect.
Incorrect. This describes Vault policies, which control authorization. Policies define what a token can do on specific paths and capabilities such as read, create, update, delete, or list. Policies do not themselves store, generate, or encrypt secrets.
- D. Incorrect.
Incorrect. This refers to storage or replication concepts rather than secrets engines. Vault storage backends persist Vault data, and enterprise replication features handle certain multi-cluster data distribution scenarios. Secrets engines operate at the logical layer to manage secrets and cryptographic functions, not to provide cluster replication.