HashiCorp Vault Associate (003) Question 144
Single answer5d Describe the purpose of secrets enginesA platform team is onboarding a new application to HashiCorp Vault. The application currently stores a long-lived database password in a configuration file, and the team wants to reduce risk by having the application request credentials from Vault at runtime. The security engineer explains that they should enable an appropriate secrets engine rather than storing the database password as a static secret in the KV engine. What is the primary purpose of using a secrets engine in this scenario?
- A
To allow Vault to generate or manage secrets for a specific system, such as issuing dynamic database credentials with leases
- B
To replace Vault policies by deciding which users are allowed to authenticate to Vault
- C
To encrypt all data sent between the application and Vault without requiring TLS
- D
To replicate secrets automatically between different Vault clusters without additional configuration
Show answer and explanation
Correct answer: A
Explanation
The key purpose of a secrets engine is to provide a backend in Vault that can store, generate, or manage secrets for a particular type of system or workflow. Common examples include the KV secrets engine for generic key-value storage, the database secrets engine for dynamic database credentials, and PKI for certificate issuance. In the scenario, using a database secrets engine is preferable because it allows Vault to issue short-lived credentials on demand, which aligns with the principle of reducing exposure from static, long-lived secrets. In Vault documentation, secrets engines are described as components that manage secrets and can support features such as dynamic secrets, leasing, and revocation, depending on the engine.
- A. Correct.
Correct. Secrets engines are the components in Vault responsible for storing, generating, or managing secrets for particular use cases. In this scenario, a database secrets engine can generate dynamic database credentials on demand and associate them with leases and TTLs, which reduces the risk of long-lived credentials being exposed.
- B. Incorrect.
Incorrect. Authentication methods verify identity, and policies authorize what an authenticated client can do. Secrets engines do not replace policies or auth methods; they provide access to secret data or secret generation workflows after authentication and authorization have already occurred.
- C. Incorrect.
Incorrect. TLS is what protects traffic between clients and Vault in transit. Secrets engines are not a substitute for transport encryption. A candidate might choose this if they confuse secret management with network security controls.
- D. Incorrect.
Incorrect. Secrets engines are not primarily responsible for cross-cluster replication behavior. Replication is a Vault platform capability configured separately in supported Vault editions. A secrets engine defines how secrets are stored or generated, not how clusters replicate data by default.