VAULT-ASSOCIATE-002 · Question #72
Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?
The correct answer is B. vault kv put secret/password value=itsasecret. Command B violates security requirements by embedding the secret value directly in the command line, which will be saved in shell history.
Question
Options
- Agenerate-password | vault kv put secret/password value=-
- Bvault kv put secret/password value=itsasecret
- Dvault kv put secret/password value=$SECRET_VALUE
How the community answered
(19 responses)- A5% (1)
- B89% (17)
- D5% (1)
Why each option
Command B violates security requirements by embedding the secret value directly in the command line, which will be saved in shell history.
This command uses `value=-`, which tells `vault kv put` to read the secret value from standard input, thus preventing the secret from appearing directly in the shell history.
This command directly specifies the secret value "itsasecret" as an argument. When executed, this literal string will be recorded in the shell's history file (e.g., .bash_history, .zsh_history), making the secret persistently visible to anyone with access to that history.
This command uses an environment variable `$SECRET_VALUE` to provide the secret, so the actual secret value itself does not appear directly in the shell command or history.
Concept tested: Preventing secrets in shell history
Source: https://developer.hashicorp.com/vault/tutorials/secrets-management/kv-secrets-engine
Topics
Community Discussion
No community discussion yet for this question.