Advanced secrets management

Correct — something must bootstrap trust; the strong answers use platform-native identity so no long-lived credential is shipped in the image.

Correct — dynamic, short-lived, per-consumer credentials shrink the window in which a stolen secret is worth anything.

Correct — isolation caps how far one breach or one fat-fingered policy can reach.

Correct — unsealing reconstructs the key that decrypts the barrier, so a stolen storage volume alone is useless.

Correct — k-of-n means a quorum unseals, so losing up to two shares is survivable and no single person can act alone.

Correct — you trade the operational pain of manual unseal for a dependency on the KMS key’s access control.

Correct — integrated storage keeps the data on the Vault nodes with built-in Raft consensus, removing the separate storage cluster.

Correct — standbys are hot spares; the active node holds the write lock and handles traffic until failover.

Correct — DR is for failover; performance replication is for scaling reads across regions with local secondaries.

Correct — role-id (public-ish) plus secret-id (sensitive, delivered out-of-band) is the split that makes AppRole safer than a single token.

Correct — single delivery is provable: a used wrapping token is a tamper signal.

Correct — the Kubernetes auth method trades the SA JWT for a Vault token at runtime — no pre-shared secret in the image.

Correct — revoking the lease kills the credential everywhere, and an already-expired stolen cred is a non-event.

Correct — lease trees let you kill an entire branch (e.g. all creds a token issued) in one action during an incident.

Correct — a consumer can renew up to max_ttl, then must obtain a fresh credential — bounding total exposure.

Correct — "encryption as a service" means Vault does the crypto and guards the key, while your database holds the ciphertext.

Correct — convergent mode trades some confidentiality (you can tell two ciphertexts share a plaintext) for the ability to dedupe or search.

Correct — rotation adds a new version; old versions remain until you retire them, so nothing breaks on rotation day.

Correct — raising the floor invalidates old versions, which (after rewrapping good data) shrinks what a leaked old key can open.

Correct — CRLs and OCSP are famously unreliable to enforce; expiry is a revocation mechanism that always works.

Correct — the root is the crown jewel — keep it cold, delegate day-to-day issuance to an intermediate that is replaceable.

Correct — controllers renew ahead of expiry so 24-hour certs are operable without humans in the loop.

Correct — envelope encryption: encrypt large data locally with the plaintext DEK, discard it, and keep the wrapped DEK for later unwrap.

Correct — unlike ciphertext (which is a transform of the plaintext), a token is a reference; compromising the algorithm alone does not reverse it.

Correct — a human who logs in via OIDC and also holds an AppRole is one entity with two aliases — policies and metadata attach once.

Correct — one templated policy replaces thousands and can never accidentally grant cross-tenant access.

Correct — deny precedence is a safety property: a mistaken broad allow cannot override a deliberate deny.

Correct — attach a policy to a group (often mapped from an external directory) and membership drives entitlement.

Correct — EGPs guard endpoints regardless of token; RGPs govern what a given token/role can do.

Correct — control groups add human approval to access, so no single person can read the most sensitive material alone.

Correct — a namespace is effectively a Vault-within-Vault, so tenants cannot see or reach each other’s mounts.

Correct — spiffe://trust-domain/workload — the SVID lets a service prove identity without any pre-shared secret.

Correct — attestation replaces the pre-shared secret: the platform vouches for the workload, then SPIRE mints a short-lived SVID.

Correct — bundle exchange establishes cross-domain trust without a shared secret or a central authority.

Correct — "who you are" beats "where you are" once addresses are ephemeral and the perimeter is porous.

Correct — no standing super-user: recreate a root on demand from recovery keys, use it, revoke it.

Correct — the shared memory volume keeps the secret off disk and out of the environment, refreshed as it renews.

Correct — CSI presents secrets as files through the kubelet’s volume machinery instead of running an injected agent alongside your app.

Correct — ESO watches an ExternalSecret CR and refreshes the native Secret so apps consume secrets the normal k8s way, kept in sync with the source of truth.

Correct — convenience (native Secret) reintroduces the etcd-at-rest exposure the external manager was partly meant to avoid — so encrypt etcd and lock down get/list.

Correct — rotate the wrapping key and re-wrap the tiny DEKs; the bulk ciphertext stays put.

Correct — the whole value proposition is that the key never exports; only wrap/unwrap operations cross the boundary.

Correct — seal wrap routes critical values through the HSM/KMS seal, which auditors credit toward FIPS requirements.

Correct — it is the common interface Vault (and others) use to offload key operations to an HSM.

Correct — pull the key and the encrypted data becomes unreadable — a powerful offboarding and containment control.

Correct — the staged-then-promoted flow means a failed rotation never leaves the app without a working credential.

Correct — match the tool to the requirement instead of defaulting to the heaviest option.

Correct — high-assurance key generation (often FIPS-driven) deliberately removes any single point of trust or failure.

Correct — the overlap means no instant in which every consumer is holding an invalid credential.

Correct — you can only retire the old credential once you are certain nothing still relies on it.

Correct — new-before-retire guarantees an always-valid credential throughout.

Correct — assume it is already harvested; kill its power first, forensics second.

Correct — plant it where an intruder would find it; the first touch is an alarm with almost no false positives.

Correct — once pushed, treat it as public forever; scrubbing the branch does not recall the copies.

Correct — stopping the leak at the boundary is far cheaper than rotating after the fact.

Correct — you can correlate access (same value hashes alike) without the log leaking the secrets it records.

Correct — auditability is treated as mandatory; run redundant audit devices so a single sink outage does not halt Vault.

Correct — no one person can invoke it; the k-of-n ceremony plus alerting makes emergency access rare, controlled, and visible.

Correct — ephemeral root on demand: create with the quorum, do the task, revoke immediately.

Correct — you find the missing recovery key or the wrong DNS TTL in a drill, not at 3am during the real thing.