HashiCorp Vault Associate (003) Question 149
Single answer5e Describe the use of response wrappingA platform team needs to deliver a short-lived AppRole SecretID from a secure CI pipeline to an application team without exposing the SecretID in pipeline logs, tickets, or chat messages. The application team can authenticate to Vault, but the platform team wants the SecretID to be retrievable only once and to expire quickly if not used. Which approach best meets this requirement?
- A
Generate the SecretID normally and send it to the application team over TLS, relying on transport encryption to protect it in transit.
- B
Use Vault response wrapping when generating the SecretID, send only the wrapping token to the application team, and have them unwrap it within the short wrap TTL.
- C
Store the SecretID in a KV v2 secret with a short TTL so the application team can read it later with their own token.
- D
Create a periodic token for the application team and let them use it instead of AppRole so the SecretID does not need to be shared.
Show answer and explanation
Correct answer: B
Explanation
Response wrapping is designed for secure secret delivery. Instead of returning the sensitive value directly, Vault returns a single-use wrapping token that contains the secret. The wrapping token has its own TTL, and once unwrapped, it cannot be used again. This reduces the exposure of the underlying secret in logs, CI output, messaging systems, or human handoffs. In practice, teams often use wrapping with AppRole SecretIDs, token creation, and other bootstrap workflows. In Vault documentation, this is commonly described as cubbyhole response wrapping: the wrapped response is stored server-side and retrieved by presenting the wrapping token to the unwrap endpoint. The key benefits relevant to this scenario are short-lived delivery, one-time access, and reduced accidental disclosure of the actual secret material.
- A. Incorrect.
This is incorrect because TLS only protects data in transit; it does not provide the one-time retrieval behavior or the additional control that response wrapping gives. If the SecretID is copied into logs, tickets, terminal history, or chat, TLS does nothing to prevent later exposure. The scenario specifically requires retrievable only once and quick expiration if unused.
- B. Correct.
This is correct. Response wrapping lets Vault return a wrapping token instead of the secret value itself. The recipient can use the wrapping token to unwrap and retrieve the SecretID exactly once, and the wrapping token can have a short TTL. This is a common best practice for securely delivering sensitive values such as SecretIDs, tokens, and credentials between systems or teams.
- C. Incorrect.
This is incorrect because KV v2 is a storage mechanism, not a one-time secure delivery mechanism for sensitive bootstrap data. A KV secret can typically be read multiple times by anyone with access, and secret data in KV does not inherently gain one-time retrieval semantics simply by assigning a short-lived consumer token. This does not satisfy the requirement as cleanly as response wrapping.
- D. Incorrect.
This is incorrect because it changes the authentication design rather than solving the secret delivery problem described. Periodic tokens are a valid Vault concept, but the scenario explicitly involves distributing an AppRole SecretID safely. Replacing AppRole with another auth method is not the best answer to the stated requirement.