HashiCorp Vault Associate (003) Question 152
Single answer5f Explain the value of short-lived, dynamically generated secretsA company is migrating a legacy application to use HashiCorp Vault for database access. Today, the application stores a shared database username and password in a configuration file, and multiple services reuse the same credentials for months at a time. The security team wants to reduce the impact of credential leaks and simplify credential cleanup when services are decommissioned. Which Vault approach provides the MOST value in this situation?
- A
Store the existing shared database password in Vault's KV secrets engine so applications can read the same long-lived credential at startup
- B
Use Vault's database secrets engine to generate dynamic database credentials with a short TTL for each application instance
- C
Enable Transit secrets engine so applications can encrypt the shared database password before placing it in their configuration files
- D
Create one static database account per team and rotate those passwords manually every quarter using Vault as a record of the new values
Show answer and explanation
Correct answer: B
Explanation
The best answer is to use Vault's database secrets engine to issue short-lived, dynamically generated credentials. In Vault, dynamic secrets are created on demand for a client and are associated with a lease. This provides several important benefits that are central to the Vault Associate exam: reduced blast radius because each app or instance can receive unique credentials; limited exposure because the credentials expire automatically after a short TTL; easier revocation because Vault can revoke leases and clean up generated accounts; and less operational burden because teams do not need to manually distribute and rotate long-lived shared passwords. By contrast, storing static secrets in KV may improve centralization but does not deliver the core value of dynamic secrets. HashiCorp documentation and best practices consistently emphasize dynamic secrets and leasing as key mechanisms for reducing standing credentials and improving secret lifecycle management.
- A. Incorrect.
This is incorrect because moving a long-lived shared password from a config file into KV improves storage and access control, but it does not provide the main value of short-lived, dynamically generated secrets. The credential is still reused across services, remains valid until manually changed, and creates cleanup and blast-radius problems if leaked.
- B. Correct.
This is correct because Vault's database secrets engine can create unique credentials on demand and attach a lease/TTL to them. Short-lived dynamic credentials reduce the exposure window if a secret is compromised, avoid credential sharing between services, and simplify cleanup because Vault can revoke or let the lease expire rather than requiring manual account tracking. This is a core security and operational benefit of dynamic secrets in Vault.
- C. Incorrect.
This is incorrect because Transit is used for cryptographic operations such as encryption, decryption, signing, and key management; it does not solve the problem of long-lived shared credentials. Encrypting a static password in a config file still leaves the organization dependent on the same reused credential and does not provide dynamic generation, leasing, or automatic revocation.
- D. Incorrect.
This is incorrect because static per-team accounts with quarterly rotation are still relatively long-lived credentials and are often shared by multiple workloads. Although manual rotation is better than never rotating, it does not match the security and operational advantages of short-lived dynamic secrets, such as minimizing blast radius, reducing standing privileges, and automating revocation.