Hashicorp Certified Vault Associate 002 · Free Practice Question Medium
Question 15
An Active Directory admin created a service account for an internal application. You want to store these credentials in Vault, allowing a CI/CD pipeline to read and configure the application with them during provisioning. Vault should maintain the last 3 versions of this secret.
Which Vault secrets engine should you use?
-
A
the KV V2 secrets engine
-
B
the Identity secrets engine
-
C
the LDAP secrets engine
-
D
the KV secrets engine
Reveal correct answer
Correct answer: A
Explanation
When you need Vault to store credentials that were created by a third-party platform, such as Active Directory or API keys from a partner website, you need to use the KV secrets engine. The KV secrets engine is the ONLY secrets engine that can actually store credentials in Vault.
Vault KV has two different versions of the KV secrets engine, version 1 and version 2. Version 2 is a versioned KV store, meaning that it can store the current and previous versions of a particular secret. You can even configure a KV V2 secrets engine to only keep a certain number of versions for a secret as well.
More information about the KV V2 secrets engine can be found here
This page also gives a good rundown on each of the versions of the KV secrets engine
A. The KV V2 secrets engine is the correct choice because it allows you to store key-value pairs, such as the service account credentials, and manage versions of those secrets. By enabling versioning, you can maintain the last 3 versions of the secret for auditing and rollback purposes, making it suitable for storing and managing the service account credentials for the internal application.
B. The Identity secrets engine is used for managing entities and their associated attributes, policies, and roles within Vault. It is not intended for storing and managing arbitrary secrets like service account credentials. For the scenario described, where you need to store and manage the service account credentials with versioning, the KV V2 secrets engine is the appropriate choice.
C. The LDAP secrets engine is used to authenticate users and machines against an LDAP server, not for storing arbitrary secrets like service account credentials. It is not designed for storing and managing the type of secret data needed for the internal application service account.
D. The KV secrets engine also allows you to store key-value pairs, but it does not support versioning like the KV V2 engine does. Without versioning, you would not be able to maintain the last 3 versions of the secret as required for auditing and rollback purposes in this scenario.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
