The first step to use the transit secrets engine is to enable it at its default path. The command ‘vault secrets enable transit’ accomplishes this. The other options either enable the wrong engine type, attempt to create a key before the engine is enabled, or incorrectly try to enable it as an auth method.

The ‘read’ capability is explicitly required to retrieve the data (secret) stored at a given path. The ‘list’ capability is for enumerating items under a path (like seeing what secrets exist), but not for reading their contents. ‘Sudo’ is for privileged operations like updating the core configuration, and ‘deny’ would explicitly block access.

The ‘default_ttl’ parameter specifies the lease duration (Time-To-Live) for credentials generated by the role. Setting this to ‘1h’ ensures each set of credentials is valid for a maximum of one hour by default. ‘max_ttl’ is a hard upper bound that the default_ttl cannot exceed. The creation and revocation statements are SQL commands for managing the credentials, not for defining their lifespan.

Response Wrapping produces a single-use, short-lived wrapper token that must be unwrapped to get the real secret or token. If the wrapped token is logged, it has a very limited lifetime and can only be used once, drastically reducing the risk compared to logging the actual long-lived credential. Control Groups add an approval step, Entity Aliases link auth methods, and Lease Renewals are for extending secret validity.

To communicate with and trust the Kubernetes API server, Vault must be configured with the Kubernetes API’s CA certificate. This allows Vault to validate the authenticity of the service account tokens it receives. While the Kubernetes host URL is also needed, the CA certificate is the critical trust component. A privileged token is not required for basic configuration, and namespaces are specified in role bindings, not the auth method config.

The ‘allow_ip_sans’ parameter must be set to ‘true’ on the PKI role to permit including IP addresses in the Subject Alternative Name field of issued certificates. ‘allowed_domains’ controls permitted DNS names. ‘key_usage’ and ‘ext_key_usage’ define how the certificate can be used (e.g., digital signature, server auth) but do not control what identifiers are allowed in the SAN.

Vault uses an HMAC (Hash-based Message Authentication Code) to transform sensitive values in audit logs. This allows Vault to later verify that a presented secret (like a token) matches the one in the log entry without storing the plaintext secret in the log. This protects sensitive data while maintaining a verifiable audit trail. The other options describe different security features.

Disaster Recovery (DR) Replication is designed for this exact scenario. It provides a standby cluster in another location that replicates all data (including tokens and leases) from the primary. In a failover scenario, the DR secondary can be promoted to primary with minimal data loss. Performance Replication only replicates secrets engines, not the core system data (tokens, policies). Active-Active is for load balancing, and snapshots are manual backups.

In Vault policy evaluation, the most specific path match is used. The first rule grants broad access to ‘apps/*’. The second rule for the more specific path ‘apps/legacy/admin-creds’ has an empty capabilities list, which implicitly denies all access. An explicit ‘deny’ capability does not exist; access is denied by omitting capabilities. The order of rules in the file does not matter; specificity does.

The first step to use the transit secrets engine is to enable it at its default path. The command ‘vault secrets enable transit’ accomplishes this. The other options either enable the wrong engine type, attempt to create a key before the engine is enabled, or incorrectly try to enable it as an auth method.0