HashiCorp Vault Associate (003) Question 236
Single answer9a Describe the Vault AgentA team is deploying a legacy web application to a fleet of virtual machines. The application cannot authenticate directly to Vault or renew its own tokens, but it can read configuration values from a local file. The team wants the application to receive short-lived database credentials from Vault without embedding a long-lived token in the app or adding Vault-specific logic to the code. Which approach best meets this requirement?
- A
Run Vault Agent on each VM to auto-authenticate to Vault, manage token renewal, and render the database credentials to a local file using a template.
- B
Use the Vault UI to generate a periodic token for each VM and store that token in the application's configuration file so the app can request database credentials directly.
- C
Configure the application to call Vault's transit secrets engine directly, because transit can provide database usernames and passwords without requiring the app to authenticate.
- D
Enable response wrapping on a static database password and place the wrapped secret in the application's startup script so the app can unwrap it locally forever.
Show answer and explanation
Correct answer: A
Explanation
The best solution is to use Vault Agent as a local helper process for workloads that cannot integrate directly with Vault. In practice, Vault Agent commonly provides three relevant capabilities: Auto-Auth to obtain a token from an auth method, token renewal and caching to reduce direct token handling by the application, and templating to render secrets to files or environment-consumable formats. This is especially useful for legacy applications that can only read local files.
For this scenario, the application needs short-lived database credentials without embedding a long-lived Vault token or implementing Vault logic. Vault Agent can authenticate using an appropriate auth method for the VM environment, retrieve dynamic credentials from Vault, and write them to a local file using a template. This aligns with HashiCorp guidance on using Vault Agent for secret injection and token management for applications that are not Vault-aware.
Key concepts relevant to Vault Associate (003): Vault Agent is not a secrets engine and does not itself create database credentials; it is a client-side daemon that authenticates, caches tokens, renews leased secrets where applicable, and renders templates. Response wrapping is for secure delivery of secret material, not ongoing secret consumption. Transit is for cryptographic operations, not credential generation.
- A. Correct.
Correct. Vault Agent is designed for exactly this kind of integration pattern. It can use Auto-Auth to authenticate to Vault on behalf of the workload, cache and renew the client token when possible, and use templating to write secrets such as dynamic database credentials to a local file the legacy application can read. This reduces the need to embed a long-lived token in the application and avoids adding direct Vault API logic to the app.
- B. Incorrect.
Incorrect. Although a periodic token can be renewed, storing a token directly in the application's configuration file undermines the goal of avoiding embedded long-lived credentials or Vault-specific credential handling in the app. It also shifts token lifecycle management to the application or operators rather than using Vault Agent's purpose-built auto-auth and renewal capabilities.
- C. Incorrect.
Incorrect. The transit secrets engine performs cryptographic operations such as encryption, decryption, signing, and key derivation. It does not generate database usernames and passwords. Dynamic database credentials are typically provided through the database secrets engine, and the workload still needs some method to authenticate to Vault to obtain them.
- D. Incorrect.
Incorrect. Response wrapping is intended for secure secret delivery with a limited unwrap window, not for indefinite local reuse. A wrapped response is single-use and expires based on its wrapping TTL. Also, a static database password does not meet the requirement for short-lived credentials. This option reflects a common misunderstanding of response wrapping as a persistent secret storage mechanism.