How would you answer an interview scenario involving secret management?

In an interview, I would first define secret management and the problem it solves, then explain how I would use a dedicated secret store, prefer short-lived federated credentials, scope access per workload, rotate regularly, audit retrieval, prevent logging, and separate secrets across environments. I would also call out the main failure mode: moving a secret from source code into an environment variable but then printing the environment or storing it in deployment logs still exposes the credential. Finally, I would describe how I would test, monitor, and safely roll back or recover the solution.