Hashicorp Certified Vault Associate 002 · Free Practice Question Medium
Question 4
From the options below, select the benefits of using the PKI (x.509 certificates) secrets engine: (select three)
-
A
Vault can act as an intermediate CA
-
B
reduces time to get a certificate by eliminating the need to generate a private key and CSR
-
C
TTLs on Vault certs are longer to ensure certificates are valid for a longer period of time
-
D
reducing, or eliminating certificate revocations
Reveal correct answers
Correct answers: A, B, D
Explanation
The PKI secrets engine generates dynamic X.509 certificates. With this secrets engine, services can get certificates without going through the usual manual process of generating a private key and CSR, submitting to a CA, and waiting for a verification and signing process to complete. Vault's built-in authentication and authorization mechanisms provide the verification functionality.
By keeping TTLs relatively short, revocations are less likely to be needed, keeping CRLs short and helping the secrets engine scale to large workloads. This, in turn, allows each instance of a running application to have a unique certificate, eliminating sharing and the accompanying pain of revocation and rollover.
In addition, by allowing revocation to mostly be forgone, this secrets engine allows for ephemeral certificates. Certificates can be fetched and stored in memory upon application startup and discarded upon shutdown, without ever being written to disk.
A. Vault has the capability to act as an intermediate Certificate Authority (CA) by issuing certificates on behalf of the root CA. This allows for a hierarchical trust model and enables Vault to manage and distribute certificates efficiently.
B. Using the PKI (x.509 certificates) secrets engine eliminates the need to manually generate a private key and certificate signing request (CSR), which saves time and simplifies the certificate issuance process.
C. This statement is incorrect as the Time-To-Live (TTL) for Vault certificates can be configured according to the organization's security policies. It is not necessarily longer to ensure certificates are valid for a longer period of time.
D. By using the PKI secrets engine, organizations can reduce or even eliminate the need for certificate revocations, as certificates can be dynamically generated and managed by Vault, reducing the risk of compromised certificates.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
