You deploy a secrets manager. Every application now fetches its secrets from it. Security asks how the applications authenticate to the vault. What is the answer?

What the interviewer is testing

Whether you recognise the secret zero problem, and whether you know the resolution that actually eliminates it rather than relocating it.

The problem

Every secrets management deployment hits this. All secrets move into the vault, access is audited and rotated — and the vault requires a credential to authenticate. That credential sits in a configuration file, an environment variable or a container image, with none of the protections the vault provides for everything else.

The whole scheme rests on a static secret that is now the highest-value target in the estate.

The resolution

Platform-attested workload identity. The cloud provider or orchestrator knows what it is running and vouches for it; the vault trusts that attestation and issues short-lived credentials. There is no secret zero at all.

Concretely: a managed identity attached to the compute resource, or workload identity federation where the platform mints a signed token asserting the workload's identity and the vault exchanges it. The credential is short-lived, automatically rotated, and never stored anywhere.

Where this is available it should be used without exception.

The fallbacks, in descending quality

Short-lived injected tokens issued by a trusted agent at start-up, reducing exposure to the token's lifetime.

Hardware-rooted identity — a TPM or secure element — anchoring trust in the machine. Suits on-premises and edge deployments where no cloud attestation exists.

A long-lived credential, which is what you are trying to avoid and is sometimes unavoidable for legacy workloads. If so, scope it narrowly, rotate it on a schedule, and monitor its use.

What a strong answer adds

The review question to apply to any secrets architecture: how does the first credential arrive? If the answer is a file on disk or a variable in a deployment manifest, the architecture has moved the problem rather than solved it.

And noting that the same reasoning applies to CI: a pipeline with a long-lived cloud key is secret zero at organisational scale, and OIDC federation is the equivalent fix.

Common weak answers

Encrypting the bootstrap credential, which requires a key that is now secret zero. Restricting file permissions, which does not survive a compromised process.