Task 5.1: Choose a secrets engine based on use case
KV, database, cloud, PKI, SSH, TOTP, transit, transform and cubbyhole matched to the problem, and which ones need Vault Enterprise.
Study it
Choosing a secrets engine for the job
Lesson coming
Sample questions
Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.
Question 1 · choose 1
Engineers need SSH access to 400 Linux hosts. Access must expire within 30 minutes, no engineer's public key may be added to any host, and the hosts must trust a single CA public key without extra software. Which Vault capability fits?
AThe SSH secrets engine issuing a one-time password to each engineer for every single connection
BThe SSH secrets engine signing each engineer's own public key into a 30-minute certificate
CThe PKI secrets engine issuing a 30-minute X.509 client certificate to each engineer
DThe SSH secrets engine signing each host's public host key with a 30-minute certificate
Show the answer and why
AThe SSH secrets engine issuing a one-time password to each engineer for every single connection
Incorrect
OTP mode depends on the vault-ssh-helper installed on every host to verify passwords, and it uses no CA key.
BThe SSH secrets engine signing each engineer's own public key into a 30-minute certificate
Correct
OpenSSH hosts that trust Vault's CA key through TrustedUserCAKeys accept short-lived certificates Vault signs, with nothing per user on the hosts.
CThe PKI secrets engine issuing a 30-minute X.509 client certificate to each engineer
Incorrect
PKI issues X.509 certificates; OpenSSH user authentication expects SSH certificates signed by a trusted SSH CA key.
DThe SSH secrets engine signing each host's public host key with a 30-minute certificate
Incorrect
Host certificates let clients trust hosts; they do not authenticate engineers to the hosts.
Signed SSH certificates use OpenSSH's built-in CA support: hosts trust one CA public key and Vault signs client keys with a short TTL.
A company runs Vault Community Edition and does not plan to buy Vault Enterprise. Which two of its requirements can it meet with the secrets engines it already has? (Choose TWO.)
AIssuing short-lived X.509 certificates for internal services
BTokenizing card numbers with format-preserving encryption
CManaging keys in cloud key management services from Vault
DGenerating time-based one-time passwords for a legacy application
ESeal-wrapping KV values to meet FIPS 140 requirements
Show the answer and why
AIssuing short-lived X.509 certificates for internal services
Correct
The PKI secrets engine issues X.509 certificates and is part of Community Edition.
BTokenizing card numbers with format-preserving encryption
Incorrect
That is the transform secrets engine, which needs Vault Enterprise or HCP Vault Dedicated.
CManaging keys in cloud key management services from Vault
Incorrect
The key management secrets engine needs Vault Enterprise or HCP Vault Dedicated.
DGenerating time-based one-time passwords for a legacy application
Correct
The TOTP secrets engine generates time-based codes and is part of Community Edition.
ESeal-wrapping KV values to meet FIPS 140 requirements
Incorrect
Seal wrapping is a Vault Enterprise feature.
Check the Enterprise label on an engine's page before designing with it: transform, key management and KMIP are Enterprise features, while PKI, TOTP, KV, transit and the database engine are not.
A team must store passwords for partner portals that change a few times a year, keep earlier values in case a change goes wrong, and protect against accidental overwrites. Which secrets engine fits?
AKV version 1, which keeps the previous value of each key
BThe cubbyhole engine, shared by the team's tokens
CKV version 2
DThe transit engine, which stores each key encrypted
Show the answer and why
AKV version 1, which keeps the previous value of each key
Incorrect
KV v1 stores only the latest value and has no versions.
BThe cubbyhole engine, shared by the team's tokens
Incorrect
Cubbyhole is neither shared between team members nor versioned.
CKV version 2
Correct
KV v2 stores static secrets with a configurable number of versions and supports check-and-set writes.
DThe transit engine, which stores each key encrypted
Incorrect
Transit encrypts data but stores none of it.
Versioned KV is the default home for static secrets that need history and protection from accidental changes.
A process needs a scratch space in Vault that no other token can read, not even a root token, and that disappears when its token expires. Which secrets engine provides it?
AKV v2 with a policy on a path named after the token
BTransit, with a key named after the token
CThe identity secrets engine, under the token's entity
DCubbyhole
Show the answer and why
AKV v2 with a policy on a path named after the token
Incorrect
KV data outlives tokens, and root can read any KV path.
BTransit, with a key named after the token
Incorrect
Transit stores no data at all.
CThe identity secrets engine, under the token's entity
Incorrect
Identity stores entities and groups, not a token's private data.
DCubbyhole
Correct
Cubbyhole paths are scoped per token, no token can access another's, and the data is destroyed when the token expires.
Cubbyhole data lives and dies with one token, so it suits per-token scratch space rather than shared secrets.
Existing Active Directory service accounts must have their passwords rotated on a schedule, and applications must read the current password from Vault. Which secrets engine should a new deployment use?
AThe LDAP secrets engine with static roles
BThe Active Directory secrets engine
CThe ldap auth method with a long token TTL for each account
DThe KV v2 engine with a rotation script
Show the answer and why
AThe LDAP secrets engine with static roles
Correct
The LDAP engine supports Active Directory schemas and automatically rotates passwords for static credentials.
BThe Active Directory secrets engine
Incorrect
HashiCorp no longer supports the Active Directory secrets engine; the LDAP engine replaces it.
CThe ldap auth method with a long token TTL for each account
Incorrect
The auth method logs users in; it does not rotate account passwords.
DThe KV v2 engine with a rotation script
Incorrect
KV stores whatever is written; it rotates nothing itself.
Check the deprecation notices before choosing an engine: the AD engine has been removed from support, and the LDAP engine covers its use cases.