nerdexam
HashiCorp

VAULT-ASSOCIATE-002 · Question #26

Which of the following statements describe the secrets engine in Vault? (Choose three.)

The correct answer is A. Some secrets engines simply store and read data C. You can build your own custom secrets engine D. Each secrets engine is isolated to its path. Vault's secrets engines are modular components that provide diverse functionalities, from simple key-value storage to dynamic secret generation, are isolated by their mount paths, and can be customized.

Submitted by weili_xi· Apr 18, 2026Understand Vault Architecture

Question

Which of the following statements describe the secrets engine in Vault? (Choose three.)

Options

  • ASome secrets engines simply store and read data
  • BOnce enabled, you cannot disable the secrets engine
  • CYou can build your own custom secrets engine
  • DEach secrets engine is isolated to its path
  • EA secrets engine cannot be enabled at multiple paths

How the community answered

(30 responses)
  • A
    87% (26)
  • B
    7% (2)
  • E
    7% (2)

Why each option

Vault's secrets engines are modular components that provide diverse functionalities, from simple key-value storage to dynamic secret generation, are isolated by their mount paths, and can be customized.

ASome secrets engines simply store and read dataCorrect

Secrets engines like the Key/Value (KV) secrets engine are designed primarily for storing and retrieving arbitrary secrets, functioning much like a secure key-value store.

BOnce enabled, you cannot disable the secrets engine

Secrets engines can be disabled using the `vault secrets disable` command, which removes the engine and all its associated data.

CYou can build your own custom secrets engineCorrect

Vault provides a plugin interface that allows users to develop and integrate their own custom secrets engines, extending Vault's capabilities beyond the built-in types.

DEach secrets engine is isolated to its pathCorrect

Each secrets engine is mounted at a specific path (e.g., `secret/`, `aws/`), and its operations are confined to that path, providing logical isolation and allowing for distinct configurations and policies.

EA secrets engine cannot be enabled at multiple paths

Many secrets engines, particularly the KV secrets engine, can be enabled multiple times at different paths, with each instance having its own isolated data and configuration.

Concept tested: Vault secrets engine characteristics and flexibility

Source: https://developer.hashicorp.com/vault/docs/concepts/secrets-engines

Topics

#secrets engine#Vault architecture#engine extensibility#path isolation

Community Discussion

No community discussion yet for this question.

Full VAULT-ASSOCIATE-002 Practice