An IoT engineer is responsible for security at an organization. Humans and machines need to be allowed to access services like database or compute on AWS. The engineer decides to implement dynamic…

Question

Options

• ACreate a central secret system for humans and machine to obtain very short-lived dynamic
• BHumans cannot be trusted, and each time they authenticate they should be issued with dynamic
• CMaintain a different service associated to secret systems to issue access.
• DAfter a user is authenticated by any trusted system, the user can be trusted to use any service.

• A
  76% (32)
• B
  7% (3)
• C
  2% (1)
• D
  14% (6)

Explanation

Option A is correct because a centralized secrets system (like HashiCorp Vault or AWS Secrets Manager) that issues short-lived, dynamically generated credentials to both humans and machines is the gold standard for least-privilege access - credentials expire quickly, limiting the blast radius of any compromise.

Why the distractors fail:

• B is a red herring - the issue isn't distrust of humans specifically; machines can be compromised too, so both humans and machines need dynamic secrets. Singling out humans misses the point.
• C is vague and architecturally backwards - maintaining a separate service just to issue secrets adds complexity without improving security; the goal is a unified central system, not fragmented ones.
• D describes a classic "castle-and-moat" fallacy - once inside, always trusted. This violates Zero Trust principles; authentication to one system should never grant blanket access to all services.

Memory tip: Think "Central + Short-lived = Safe" - dynamic secrets work because they're both centralized (one authoritative source) and ephemeral (expire before they can be abused). If an answer combines those two properties, it's almost always correct.

No community discussion yet for this question.