Compare and configure secrets engines practice questions

The database engine requires a separate seal configuration.

Why wrong: Incorrect. All secrets engines share the same seal configuration; there is no separate seal for the database engine.

The database engine configuration is stored in a different location that is not sealed.

Why wrong: Incorrect. All storage in Vault is sealed using the same master key; there is no unsealed location.

The database engine uses a separate encryption key that was not re-wrapped after changing the seal configuration.

Why wrong: Incorrect. The database secrets engine does not use a separate encryption key that requires re-wrapping. All data is encrypted with the master key, and a seal change does not affect decryption as long as the master key is accessible.

Set the role's 'initial_lease_status' to 'expired' to trigger immediate deletion.

Why wrong: Incorrect. The role's 'initial_lease_status' parameter is not a valid parameter in the AWS secrets engine.

Set the role's 'rotate' parameter to 'true' to rotate credentials on lease renewal.

Why wrong: Incorrect. The 'rotate' parameter is for rotating credentials on lease renewal, not for triggering deletion.

Set the mount's 'default_lease_ttl' to a finite duration.

Why wrong: Incorrect. While setting mount-level TTL can influence lease duration, the role-level 'ttl' is the specific and required parameter to ensure automatic deletion.

Set the role's 'credential_type' to 'iam_user' and include the 'delete' operation in 'policy_arns' or use a custom inline policy allowing deletion.

Why wrong: Incorrect. The 'policy_arns' or inline policy defines permissions for the IAM user, not for Vault. Vault needs its own AWS credentials with delete permission, configured via the AWS secrets engine's root credentials.

The AWS secrets engine is enabled at path aws/ and will generate IAM users with full admin access

Why wrong: The enable command used -path=internal/aws, so the mount path is internal/aws, not aws/.

The commands will fail because the AWS secrets engine cannot be enabled at a custom path

Why wrong: Vault allows enabling any secrets engine at any path.

The AWS secrets engine is enabled at path internal/aws and will generate STS credentials

Why wrong: The credential_type is iam_user, not federation_token or assumed_role.

Schedule a cron job to periodically read new credentials.

Why wrong: Cron job is a manual workaround and not an automated renewal.

Set a longer default TTL on the role.

Why wrong: Increasing TTL only prolongs lease but does not automate renewal.

Set a longer max TTL on the mount.

Why wrong: Max TTL limits the maximum lease duration, not renewal behavior.

Cubbyhole

Why wrong: Cubbyhole is a per-token private store, not for sharing static secrets.

KV v1

Why wrong: KV v1 does not support versioning or rollback.

Transit

Why wrong: Transit is an encryption engine, not for storing secrets.

The Vault write operation failed due to network latency.

Why wrong: Network latency would cause an error, not eventual consistency delay.

The TTL on the role is too short.

Why wrong: TTL affects lease duration, not creation delay.

Vault must wait for the AWS secret key to be rotated before returning the user.

Why wrong: Secret key rotation is unrelated to user creation availability.

Implement certificate pinning in all services.

Why wrong: Pinning is a security measure, not a revocation mechanism.

Set a very short TTL on certificates so they expire quickly.

Why wrong: Short TTL reduces risk but does not revoke; service still valid until expiration.

Configure a Certificate Revocation List (CRL) that clients check.

Why wrong: CRL is a mechanism for clients to check revocation, not automatic revocation.

PKI

Why wrong: PKI issues certificates, not encryption of arbitrary data.

KV v2

Why wrong: KV v2 is for storing secrets, not encryption operations.

Database

Why wrong: Database engine manages database credentials.

Create a separate Vault cluster for that secrets engine.

Why wrong: That would be overly complex and not a replication feature.

Disable replication on that specific mount.

Why wrong: Replication is per cluster, not per mount; cannot disable for a single mount.

Use disaster recovery (DR) replication and exclude the mount.

Why wrong: DR replication replicates all mounts; cannot exclude specific ones.

The TTL on the role is set too low.

Why wrong: TTL only affects lease duration, not the validity of credentials.

The connection string provided to Vault is incorrect.

Why wrong: If connection string was wrong, Vault wouldn't be able to create credentials.

The generated credentials were revoked by Vault before the application used them.

Why wrong: Revocation happens on lease expiration or explicit request, not immediately.

Transit

Why wrong: Transit does not support listing; it only provides encryption operations.

Cubbyhole

Why wrong: Cubbyhole does not support listing.

PKI

Why wrong: PKI does not support listing of certificates in that way.

Storing encryption keys

Why wrong: Transit manages keys but does not allow direct export of keys (unless exportable).

Storing encrypted data at rest

Why wrong: Transit does not store data; it only provides encryption operations.

Managing X.509 certificates

Why wrong: PKI engine manages certificates, not Transit.

It does not support deletion of secrets.

Why wrong: KV v2 supports deletion by creating a delete version.

It does not support undoing changes.

Why wrong: KV v2 allows reading older versions, effectively undoing changes.

AWS

Why wrong: Incorrect. AWS is a valid secrets engine, but it is not one of the two correct answers for this question.

LDAP

Why wrong: Incorrect. LDAP is an auth method, not a secrets engine.

Transit

Why wrong: Incorrect. Transit is a valid secrets engine, but it is not one of the two correct answers for this question.

The replication path filter excludes the database engine mount.

Why wrong: The filter includes all mounts, so it's not excluded.

The secondary cluster has a network issue preventing it from connecting to the database.

Why wrong: The secondary does not directly connect to the database; it uses the configuration from primary.

The secondary cluster is configured to only serve static secrets.

Why wrong: Secondary can serve all replicated mounts, but dynamic secrets require primary.

Set max_ttl to 2 hours on the database role.

Why wrong: max_ttl only sets an upper bound; the default TTL remains 1 hour unless the application explicitly requests a longer TTL.

Set the Vault server's default_lease_ttl to 2 hours in the server configuration.

Why wrong: This changes the global default for all secrets, which could weaken security for other secrets and is not targeted.

Have the application manually renew the lease every 30 minutes.

Why wrong: Manual renewal is operationally complex and risks interruption if renewal fails; it is less efficient than adjusting the TTL.

vault kv list kv-v2/secret

Why wrong: This lists keys under the path, but not the secret content.

vault read kv-v2/data/secret

Why wrong: The correct path is 'kv-v2/data/secret' but the command syntax is 'vault kv get', not 'vault read' directly for KV v2.

vault kv metadata get kv-v2/secret

Why wrong: This shows metadata, not the secret data.

Configure the Kubernetes auth role to use 'token_policies' with a restrictive policy and ensure the bound service account names are correct.

Why wrong: This is already assumed to be done; the issue is the policy content, not the binding.

Create a new secrets engine for each team and mount them at 'team-alpha' and 'team-beta', then assign each service to its respective engine.

Why wrong: While this would work, it is overkill and not necessary; policy restrictions on the existing engine are sufficient.

Add a 'path_deny' capability in the policy for the disallowed paths.

Why wrong: Vault policies use 'deny' as a capability only in Sentinel policies, not in standard ACL policies; the correct approach is to simply not grant access.

Use the transit secrets engine to encrypt the static credentials and distribute them

Why wrong: Transit is for encryption/decryption, not for generating dynamic credentials.

Use the PKI secrets engine to issue certificates for database authentication

Why wrong: PKI issues certificates, not database usernames/passwords.

Store the credentials in KV v2 and have each instance read them

Why wrong: KV v2 stores static credentials, not dynamic, and does not generate unique credentials per instance.

vault secrets enable -custom-path=my-aws aws

Why wrong: Invalid: the flag '-custom-path' does not exist; use '-path'.

vault secrets enable -mount-path=my-aws aws

Why wrong: Invalid: the flag '-mount-path' does not exist; use '-path'.

vault secrets enable my-aws aws

Why wrong: Invalid: placing the path before the engine type without the '-path' flag is incorrect syntax; the path must be specified with '-path'.