nerdexam
HashiCorp

VAULT-ASSOCIATE-002 · Question #72

Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?

The correct answer is B. vault kv put secret/password value=itsasecret. Command B violates security requirements by embedding the secret value directly in the command line, which will be saved in shell history.

Submitted by tarun92· Apr 18, 2026Secure Vault

Question

Security requirements demand that no secrets appear in the shell history. Which command does not meet this requirement?

Options

  • Agenerate-password | vault kv put secret/password value=-
  • Bvault kv put secret/password value=itsasecret
  • Dvault kv put secret/password value=$SECRET_VALUE

How the community answered

(19 responses)
  • A
    5% (1)
  • B
    89% (17)
  • D
    5% (1)

Why each option

Command B violates security requirements by embedding the secret value directly in the command line, which will be saved in shell history.

Agenerate-password | vault kv put secret/password value=-

This command uses `value=-`, which tells `vault kv put` to read the secret value from standard input, thus preventing the secret from appearing directly in the shell history.

Bvault kv put secret/password value=itsasecretCorrect

This command directly specifies the secret value "itsasecret" as an argument. When executed, this literal string will be recorded in the shell's history file (e.g., .bash_history, .zsh_history), making the secret persistently visible to anyone with access to that history.

Dvault kv put secret/password value=$SECRET_VALUE

This command uses an environment variable `$SECRET_VALUE` to provide the secret, so the actual secret value itself does not appear directly in the shell command or history.

Concept tested: Preventing secrets in shell history

Source: https://developer.hashicorp.com/vault/tutorials/secrets-management/kv-secrets-engine

Topics

#Shell history#CLI security#Secrets management#Vault CLI

Community Discussion

No community discussion yet for this question.

Full VAULT-ASSOCIATE-002 Practice