HashiCorp Vault Associate (003) Question 145
Single answer5e Describe the use of response wrappingA platform team is onboarding a new application in a restricted network segment. For security reasons, the team does not want the CI/CD pipeline to send a newly created Vault token directly to the application bootstrap process, because logs or middleware might expose the token in transit. The team wants the bootstrap process to receive only a short-lived reference that it can exchange one time for the real secret material. Which Vault approach best meets this requirement?
- A
Use response wrapping so the pipeline receives a wrapping token, sends that token to the application, and the application unwraps it once to retrieve the original token
- B
Enable a longer TTL on the application token so it remains valid if it is intercepted during startup
- C
Store the application token in a KV v2 secret and let the bootstrap process read it later with a generic read operation
- D
Use the transit secrets engine to encrypt the application token, then have the application decrypt it with the same transit key
Show answer and explanation
Correct answer: A
Explanation
Response wrapping in Vault is a security feature used to deliver sensitive data, such as tokens, AppRole SecretIDs, or other secrets, without exposing the actual value directly to intermediate systems. When a response is wrapped, Vault returns a wrapping token instead of the secret data. That wrapping token has its own TTL and can be unwrapped one time to reveal the original response. This is a common best practice for secure secret handoff workflows, especially across CI/CD systems, orchestrators, or segmented networks where logs, proxies, or operators should not see the underlying credential. In HashiCorp Vault documentation, response wrapping is described as a cubbyhole-based mechanism for one-time delivery of secrets and is commonly used with token creation and AppRole bootstrapping workflows. The key ideas candidates should recognize are: the recipient gets only a temporary wrapping token, unwrap is single-use, and the wrapping TTL limits exposure if the wrapper is intercepted.
- A. Correct.
Correct. Response wrapping is designed for exactly this handoff pattern. Vault can wrap a response in a single-use wrapping token with a short TTL. The sender passes only the wrapping token to the recipient, and the recipient calls unwrap to retrieve the original secret or token. This reduces exposure of the actual secret material in logs, intermediaries, or transport paths.
- B. Incorrect.
Incorrect. Increasing the TTL makes the token remain usable for longer, which increases risk if the token is exposed. It does not address the problem of safely delivering the token through potentially observable systems. Response wrapping reduces exposure by transmitting a temporary single-use reference instead of the secret itself.
- C. Incorrect.
Incorrect. Storing a token in KV just moves the sensitive value to another location and requires the application to already have Vault access to retrieve it. It also does not provide the one-time handoff behavior the scenario asks for. Response wrapping specifically supports secure delivery of secret material between trusted parties.
- D. Incorrect.
Incorrect. Transit can encrypt and decrypt data, but this is not the intended solution for one-time secret handoff in this scenario. The application would need authorization to decrypt, key management would be required, and the encrypted token could still be replayed until the underlying token expires. Response wrapping provides a short-lived, single-use mechanism purpose-built for secure secret delivery.