HashiCorp Vault Associate (003) Question 142
Single answer5d Describe the purpose of secrets enginesA platform team is replacing hard-coded database passwords in an application with HashiCorp Vault. The team wants the application to receive short-lived PostgreSQL credentials generated on demand, so each deployment gets unique credentials that can be revoked automatically when no longer needed. Which Vault capability should the team use for this requirement?
- A
Enable a database secrets engine and configure it to generate dynamic database credentials for the application's role
- B
Store the PostgreSQL administrator password in the KV secrets engine and let the application read that static secret at startup
- C
Use the transit secrets engine so Vault can encrypt the database password and return the encrypted value to the application for login
- D
Configure an auth method only, because auth methods both authenticate the application and generate database users automatically
Show answer and explanation
Correct answer: A
Explanation
The purpose of Vault secrets engines is to manage secret data and secret-related operations. Depending on the engine, Vault can store static secrets, generate dynamic secrets, or perform cryptographic operations. In this scenario, the requirement is for on-demand, short-lived PostgreSQL credentials with automatic revocation, which is exactly what the database secrets engine is designed to provide. This is a core best practice in Vault: prefer dynamic, leased credentials over long-lived static credentials when the target system supports it. By contrast, the KV secrets engine stores data but does not generate database users, transit handles cryptographic operations rather than credential issuance, and auth methods only verify identity so a client can access Vault. HashiCorp documentation distinguishes these responsibilities clearly: auth methods authenticate, secrets engines manage secrets, and the database secrets engine supports dynamic credentials with leases and revocation.
- A. Correct.
Correct. Secrets engines are the Vault components used to store, generate, or encrypt data such as secrets. The database secrets engine is specifically designed to generate dynamic database credentials on demand, attach leases to them, and support revocation. This matches the requirement for short-lived, unique PostgreSQL credentials per deployment.
- B. Incorrect.
Incorrect. The KV secrets engine is appropriate for storing static secrets, not generating dynamic database users. While it could hold a fixed database password, that does not meet the requirement for unique, short-lived credentials that can be revoked automatically. This option reflects the common misconception that all secret-related use cases should use KV.
- C. Incorrect.
Incorrect. The transit secrets engine provides cryptographic functions such as encryption, decryption, signing, and key management, but it does not create database accounts or issue database login credentials. Encrypting a password is not the same as dynamically generating and leasing credentials for application access.
- D. Incorrect.
Incorrect. Auth methods are used to authenticate identities to Vault and obtain a token, not to generate secrets by themselves. An application still needs a secrets engine, such as the database secrets engine, after authentication. This option confuses authentication with secret generation.