Compare and configure secrets engines practice questions

Implement certificate pinning in all services.

Why it fails: Pinning is a security measure, not a revocation mechanism.

Set a very short TTL on certificates so they expire quickly.

Why it fails: Short TTL reduces risk but does not revoke; service still valid until expiration.

Configure a Certificate Revocation List (CRL) that clients check.

Why it fails: CRL is a mechanism for clients to check revocation, not automatic revocation.

Create a separate Vault cluster for that secrets engine.

Why it fails: That would be overly complex and not a replication feature.

Disable replication on that specific mount.

Why it fails: Replication is per cluster, not per mount; cannot disable for a single mount.

Use disaster recovery (DR) replication and exclude the mount.

Why it fails: DR replication replicates all mounts; cannot exclude specific ones.

The TTL on the role is set too low.

Why it fails: TTL only affects lease duration, not the validity of credentials.

The connection string provided to Vault is incorrect.

Why it fails: If connection string was wrong, Vault wouldn't be able to create credentials.

The generated credentials were revoked by Vault before the application used them.

Why it fails: Revocation happens on lease expiration or explicit request, not immediately.

Transit

Why it fails: Transit does not support listing; it only provides encryption operations.

Cubbyhole

Why it fails: Cubbyhole does not support listing.

PKI

Why it fails: PKI does not support listing of certificates in that way.

AWS

Why it fails: Incorrect. AWS is a valid secrets engine, but it is not one of the two correct answers for this question.

LDAP

Why it fails: Incorrect. LDAP is an auth method, not a secrets engine.

Transit

Why it fails: Incorrect. Transit is a valid secrets engine, but it is not one of the two correct answers for this question.

The replication path filter excludes the database engine mount.

Why it fails: The filter includes all mounts, so it's not excluded.

The secondary cluster has a network issue preventing it from connecting to the database.

Why it fails: The secondary does not directly connect to the database; it uses the configuration from primary.

The secondary cluster is configured to only serve static secrets.

Why it fails: Secondary can serve all replicated mounts, but dynamic secrets require primary.

The database engine requires a separate seal configuration.

Why it fails: Incorrect. All secrets engines share the same seal configuration; there is no separate seal for the database engine.

The database engine configuration is stored in a different location that is not sealed.

Why it fails: Incorrect. All storage in Vault is sealed using the same master key; there is no unsealed location.

The database engine uses a separate encryption key that was not re-wrapped after changing the seal configuration.

Why it fails: Incorrect. The database secrets engine does not use a separate encryption key that requires re-wrapping. All data is encrypted with the master key, and a seal change does not affect decryption as long as the master key is accessible.

Set max_ttl to 2 hours on the database role.

Why it fails: max_ttl only sets an upper bound; the default TTL remains 1 hour unless the application explicitly requests a longer TTL.

Set the Vault server's default_lease_ttl to 2 hours in the server configuration.

Why it fails: default_lease_ttl sets the TTL applied when a role or mount specifies none; the database role already sets 1 hour, which overrides it, so leases still expire early. It is tempting as a global setting, and it is correct when you want a system-wide fallback TTL for mounts that omit one.

Have the application manually renew the lease every 30 minutes.

Why it fails: Manual renewal every 30 minutes works but requires custom application logic and error handling, adding operational overhead the question asks to avoid. It is tempting because renewal is the mechanism that extends a lease, and it is correct when the client genuinely needs to control its own credential lifecycle rather than have Vault manage it.

Set the role's 'initial_lease_status' to 'expired' to trigger immediate deletion.

Why it fails: Incorrect. The role's 'initial_lease_status' parameter is not a valid parameter in the AWS secrets engine.

Set the role's 'rotate' parameter to 'true' to rotate credentials on lease renewal.

Why it fails: Incorrect. The 'rotate' parameter is for rotating credentials on lease renewal, not for triggering deletion.

Set the mount's 'default_lease_ttl' to a finite duration.

Why it fails: Incorrect. While setting mount-level TTL can influence lease duration, the role-level 'ttl' is the specific and required parameter to ensure automatic deletion.

Set the role's 'credential_type' to 'iam_user' and include the 'delete' operation in 'policy_arns' or use a custom inline policy allowing deletion.

Why it fails: Incorrect. The 'policy_arns' or inline policy defines permissions for the IAM user, not for Vault. Vault needs its own AWS credentials with delete permission, configured via the AWS secrets engine's root credentials.

vault kv list kv-v2/secret

Why it fails: This lists keys under the path, but not the secret content.

vault read kv-v2/data/secret

Why it fails: The correct path is 'kv-v2/data/secret' but the command syntax is 'vault kv get', not 'vault read' directly for KV v2.

vault kv metadata get kv-v2/secret

Why it fails: This shows metadata, not the secret data.

The creation_statements do not include the REVOKE command

Why it fails: Vault's database secrets engine revokes credentials itself at TTL expiry by calling the revocation_statements; the creation_statements only run when the credential is issued. Adding REVOKE there is tempting because SQL revokes are familiar, but the revocation_statements field is where that SQL belongs.

The role definition has a syntax error in the creation_statements

Why it fails: A syntax error in creation_statements would make credential generation fail outright, not leave issued credentials unrevoked at TTL. Syntax errors are a tempting suspect because malformed statements are a common configuration fault, but they surface as creation errors, whereas the reported symptom is revocation never firing.

The secrets engine is enabled at a path other than 'database/'

Why it fails: The mount path is irrelevant to revocation; Vault tracks leases against the role regardless of where the engine is mounted. A non-default path is tempting because path mismatches break many Vault operations, but lease revocation depends on the role's revocation_statements and the lease TTL, not the mount point.

Consul: Stores data in encrypted files on disk with manual replication.

Why it fails: Incorrect. This description matches the File backend, not Consul. Consul uses a key-value store, not files on disk.

Integrated Raft: Stores data in an external key-value store like etcd.

Why it fails: Incorrect. Integrated Storage (Raft) is built into Vault and does not rely on an external store. Etcd is a separate backend.

AWS secrets engine

Why it fails: AWS generates dynamic AWS credentials, not for storing arbitrary static secrets.

PKI secrets engine

Why it fails: PKI issues certificates, not for static secrets.

Transit secrets engine

Why it fails: Transit provides encryption as a service, not static secret storage.

Set a strong master key for the Vault cluster

Why it fails: A strong master key protects the barrier but does not prevent admins from reading decrypted secrets.

Configure storage backend encryption using a KMS

Why it fails: Storage encryption protects at rest but Vault can decrypt and expose to admins.

Both A and B

Why it fails: While both provide layers, only B ensures admins cannot read plaintext; A does not prevent that.

The AWS secrets engine can only generate static access keys

Why it fails: AWS engine generates dynamic credentials (STS or IAM users).

The Database secrets engine requires a root database user for all configurations

Why it fails: It can use non-root users with sufficient privileges.

The Transit secrets engine can generate dynamic database credentials

Why it fails: Transit provides encryption, not dynamic credentials.

Using the engine to generate one-time passwords

Why it fails: Transit does not generate OTPs; that is for SSH or One-Time Password engines.

Configuring the engine to export the key in plaintext

Why it fails: Exporting keys is not a standard configuration; by default keys are non-exportable.

Setting a TTL on the key itself

Why it fails: Transit keys have a min_decryption_version but no TTL.

The AWS secrets engine is enabled at path aws/ and will generate IAM users with full admin access

Why it fails: The enable command used -path=internal/aws, so the mount path is internal/aws, not aws/.

The commands will fail because the AWS secrets engine cannot be enabled at a custom path

Why it fails: Vault allows enabling any secrets engine at any path.

The AWS secrets engine is enabled at path internal/aws and will generate STS credentials

Why it fails: The credential_type is iam_user, not federation_token or assumed_role.

The key is automatically rotated every 30 days

Why it fails: Key rotation is not automatic every 30 days; rotation must be manually triggered via CLI or API.

The ciphertext is base64 encoded, and the plaintext is base64 decoded automatically

Why it fails: While ciphertext is base64 encoded, the plaintext is not automatically decoded; the Transit engine returns base64-encoded plaintext that the client must decode separately.

The encryption operation will fail because the key type 'aes256-gcm96' is incorrect

Why it fails: The key type 'aes256-gcm96' is valid in Vault Transit, so encryption will succeed.

The namespace was changed during the upgrade

Why it fails: This is incorrect because namespaces are not automatically changed during an upgrade; they remain as configured.

The transit engine can only be mounted at the default path 'transit/'

Why it fails: This is incorrect because the transit secrets engine can be mounted at any desired path, not just the default 'transit/'.

The plugin version is incompatible with the new Vault version

Why it fails: This is incorrect because the transit secrets engine is built-in to Vault and does not have a separate plugin that could become incompatible with a new version.

vault list sys/mounts

Why it fails: `vault list sys/mounts` is not a valid command because `sys/mounts` does not support the list operation.

vault secrets show

Why it fails: `vault secrets show` is not a valid Vault CLI command.

vault read sys/mounts

Why it fails: `vault read sys/mounts` is not a valid command in the Vault CLI; the correct way to read this endpoint is through `vault secrets list`.