How would you answer an interview scenario involving secrets management in Cloud Security?

For an interview scenario involving secrets management, I would first clarify the business goal, scale, constraints, and the failure or quality attribute the interviewer wants to explore. Secrets management stores passwords, tokens, certificates, and API keys in a protected service rather than application files or source control. In this scenario, an application currently reads a database password from an environment variable populated manually. Describe a safer cloud-native approach. For production, use a vault, workload identity, short-lived credentials, automated rotation, and tightly scoped retrieval permissions. I would then explain the main alternatives and tradeoffs, identify likely failure modes, and describe how I would validate the solution through testing, observability, security controls, and recovery or rollback planning.