HashiCorp Vault Associate (003) Question 150
Single answer5f Explain the value of short-lived, dynamically generated secretsA company is moving a legacy web application to HashiCorp Vault. Today, all application servers share the same long-lived database username and password stored in a configuration file. The security team wants to reduce the impact of credential leakage and avoid manual password rotation whenever a server is added or removed. Which Vault approach best addresses these goals?
- A
Store the existing shared database password in Vault KV and let all application servers read it at startup
- B
Use the database secrets engine to generate dynamic database credentials with a short TTL for each application instance
- C
Enable Transit so the application can encrypt the database password before saving it in its configuration file
- D
Create one static database account per environment in Vault and rotate it manually during maintenance windows
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use Vault's database secrets engine to issue dynamic, short-lived database credentials. In Vault, dynamic secrets are generated on demand for a client and leased for a limited time. Their value is practical and security-focused: they reduce credential reuse, limit blast radius if a secret is exposed, and reduce operational overhead because Vault can revoke or allow expiration of credentials automatically rather than relying on manual rotation of static credentials. This aligns with HashiCorp guidance on dynamic secrets and leases: credentials should be ephemeral where possible, especially for systems like databases and cloud platforms. By contrast, storing static secrets in KV centralizes storage but does not make them short-lived, and Transit addresses encryption use cases rather than credential lifecycle management.
- A. Incorrect.
Incorrect. Storing a shared static password in KV may centralize secret access, but it does not provide the core benefits of short-lived, dynamically generated secrets. The credential is still long-lived, reused across servers, and its compromise affects every instance using it. It also does not eliminate the operational burden of rotating a shared password across many application nodes.
- B. Correct.
Correct. Vault's database secrets engine can generate unique, short-lived credentials on demand for each client or application instance. This reduces blast radius because leaked credentials expire automatically and are not shared broadly. It also improves operational efficiency by avoiding manual rotation of a single shared password when infrastructure changes. This is a primary value proposition of dynamic secrets in Vault.
- C. Incorrect.
Incorrect. Transit encrypts data without requiring the application to handle encryption keys directly, but it does not solve the problem of long-lived shared database credentials. Encrypting a static password at rest in a configuration file still leaves the organization dependent on a reused credential that must eventually be rotated and can still be exposed during use.
- D. Incorrect.
Incorrect. A static account per environment is somewhat better than one shared account for the entire organization, but it remains a long-lived credential model. Manual rotation during maintenance windows increases operational burden and leaves a larger exposure window if credentials are leaked. This option does not provide the short-lived, automatically expiring access that dynamic secrets are designed to deliver.