Skip to content

Interview question · Identity, OAuth & Access Control

How do secret managers work: authenticating workloads, dynamic secrets with leases, rotation, and solving the 'secret zero' problem?

Moving passwords from config files into a secret manager helps only if the application's way of logging in to the secret manager is not itself a password in a config file.

hardNewPreparation tags: Amazon, Google, MicrosoftUpdated Nov 2026

Moving passwords from config files into a secret manager helps only if the application's way of logging in to the secret manager is not itself a password in a config file.

Make your first attempt

What would you say before reading the answer?

  1. 01 State the assumptions your answer depends on.
  2. 02 Explain the mechanism and choose a control.
  3. 03 Name a condition that would change your decision.

The worked answer includes an approach, scoring criteria and follow-up questions. Compare the reasoning with your own.

10 answers per topic instead of 5, plus saved progress and bookmarks · costs nothingor unlock all 529 remaining answers · $25

Every worked answer in all 17 topics, every lesson in every course, the full concept curriculum, the complete practice-test bank, and the downloadable security field guides.

6 months · One payment · No auto-renewal

What if · the follow-ups in this answer

The answer works through 6 follow-ups like an interviewer would

A service connects to PostgreSQL with a static password stored in a secrets manager, shared by all instances and unchanged for two years.

  1. What does a secret manager provide?
  2. How does the service authenticate to the secret manager?
  3. What are dynamic secrets?
  4. What changes for incident response?
  5. What must the application handle?
  6. What would you change?

Each rung has a nudge, a model answer, the principle that carries over and the weak answer to avoid. Premium opens every answer and ladder.

UP NEXT ON YOUR JOURNEY
DISCUSSION · 0

No comments yet. Share a correction or a different way to answer it.