HashiCorp Vault Associate (003) Question 146
Single answer5e Describe the use of response wrappingA platform team needs to deliver a newly generated database credential from Vault to a bootstrap process running on a remote VM. They want to reduce the chance that the secret is exposed in logs, shell history, or by an intermediary service. The bootstrap process can make a second call to Vault after it starts, but the team does not want the intermediary to see the actual credential value. Which approach best meets this requirement?
- A
Use response wrapping so the intermediary only receives a single-use wrapping token, and let the VM unwrap it to retrieve the database credential from Vault.
- B
Store the database credential in a Cubbyhole path manually and have the VM read it later with any valid Vault token.
- C
Issue a periodic token to the intermediary and let it renew that token until the VM is ready to receive the credential directly.
- D
Encrypt the database credential with Vault transit and send the ciphertext to the VM without any additional Vault interaction.
Show answer and explanation
Correct answer: A
Explanation
Response wrapping is a Vault feature used to protect sensitive responses during delivery. Instead of returning the secret directly, Vault can return a wrapping token that references the original response. The recipient later calls Vault to unwrap it. This is especially useful for secret-zero and bootstrap scenarios, or whenever an intermediary transports data but should not learn the secret itself. Key properties include a separate wrapping TTL and single-use unwrap semantics. By contrast, Cubbyhole is bound to the creating token, periodic tokens are about token renewal rather than secret transport, and Transit is for encryption/decryption workflows rather than secure response handoff. This aligns with HashiCorp Vault documentation and best practices for response wrapping and secure secret delivery.
- A. Correct.
Correct. Response wrapping is designed for secure secret delivery when an untrusted or less-trusted intermediary is involved. Vault returns a wrapping token instead of exposing the secret in the response body. The recipient then calls the unwrap endpoint to obtain the original secret. The wrapping token is single-use and has its own TTL, which limits exposure if intercepted. This matches the scenario because the intermediary can pass along the wrapping token without seeing the credential itself.
- B. Incorrect.
Incorrect. Cubbyhole is token-scoped storage, so data written there is only accessible with the same token that created it. It is not a general-purpose handoff location that any valid Vault token can read. This option reflects a common misconception that Cubbyhole is shared storage. In practice, manually placing the secret in Cubbyhole would not solve the secure delivery problem described here.
- C. Incorrect.
Incorrect. A periodic token addresses token lifetime and renewal, not secure one-time delivery of secret values through an intermediary. The intermediary would still be able to access and potentially expose the actual database credential if it retrieved it directly. This does not meet the requirement to prevent the intermediary from seeing the secret value.
- D. Incorrect.
Incorrect. Transit can encrypt data, but this approach shifts the problem rather than solving the secret-delivery workflow described. The VM would still need a way to decrypt the ciphertext, which typically requires Vault access and appropriate permissions. Response wrapping is the purpose-built mechanism for securely passing a secret or response through an intermediary without revealing the underlying value.