HashiCorp Vault Associate (003) Question 143
Single answer5d Describe the purpose of secrets enginesA company is moving several internal applications to HashiCorp Vault. The security team wants developers to stop storing long-lived database passwords in configuration files. Instead, each application should receive short-lived database credentials when it starts, and those credentials should be automatically revoked after they expire. Which Vault capability should the team use to meet this requirement?
- A
Enable a database secrets engine and configure a role that generates dynamic database credentials with leases
- B
Store a shared database password in the KV secrets engine and let each application read the same secret at startup
- C
Create an auth method that directly rotates the database user's password every time an application logs in
- D
Use Vault policies alone to generate per-application database usernames and passwords without enabling any secrets engine
Show answer and explanation
Correct answer: A
Explanation
The purpose of a Vault secrets engine is to manage secrets-related operations, including storing static secrets, generating dynamic secrets, and performing cryptographic operations, depending on the engine type. In this scenario, the requirement is for short-lived, automatically revocable database credentials, which is a classic use case for the database secrets engine. Auth methods and policies are also part of the overall solution, but they serve different purposes: auth methods authenticate clients to Vault, and policies authorize what those clients can access. HashiCorp documentation describes secrets engines as pluggable components that can store, generate, or encrypt data, with engines like KV for static secrets and database for dynamic database credentials. This distinction is central to understanding the purpose of secrets engines for the Vault Associate exam.
- A. Correct.
Correct. Secrets engines are the Vault components responsible for storing, generating, or encrypting data. In this scenario, the database secrets engine is designed to generate dynamic database credentials on demand. Those credentials are issued with a lease and can expire or be revoked automatically, which directly addresses the requirement to avoid long-lived static passwords.
- B. Incorrect.
Incorrect. The KV secrets engine is appropriate for storing static secrets, such as an existing password value, but it does not generate dynamic database users or automatically revoke database credentials after lease expiration in the way the database secrets engine does. This is a common misconception because KV is often the first engine users learn, but it is not the right tool for dynamic credential generation.
- C. Incorrect.
Incorrect. Auth methods verify identity and allow a client to obtain a Vault token; they do not themselves generate database credentials for external systems. While an application must authenticate to Vault before reading secrets, the purpose of an auth method is different from the purpose of a secrets engine. Confusing authentication with secret generation is a common mistake.
- D. Incorrect.
Incorrect. Vault policies control what authenticated clients are allowed to do within Vault, such as read from a path or generate credentials from a role. Policies do not generate secrets by themselves. The actual generation of database credentials requires an appropriate secrets engine, such as the database secrets engine.