What makes a credential a dynamic secret rather than a static one?

Why this is the answer

A dynamic secret does not exist until a client asks for it: Vault creates the credential in the target system on demand and destroys it when the lease expires, so no two clients share one and revocation is per-client. The second option describes a static KV secret — one stored value, many readers. Scheduled rotation is a property some static secrets have and does not make them dynamic, because the credential still pre-exists between rotations. Replication is an availability concern and says nothing about how the credential is created.