HashiCorp Vault Associate (003) Question 135
Single answer5c Describe the uses of transit secrets engineA development team is building a payment application that must encrypt credit card numbers before storing them in a database. The security team does not want the application servers to store or retrieve raw encryption keys, but the application still needs to encrypt, decrypt, and occasionally generate HMACs to verify message integrity. Which Vault capability is the best fit for this requirement?
- A
Use the transit secrets engine so the application sends data to Vault for cryptographic operations while Vault manages the key material
- B
Use the KV secrets engine to store the encryption key, let the application read the key at startup, and perform encryption locally
- C
Use the database secrets engine to generate dynamic database credentials, which can also encrypt and decrypt application data
- D
Use the PKI secrets engine to issue certificates to the application and use those certificates directly to encrypt database fields
Show answer and explanation
Correct answer: A
Explanation
The best answer is the transit secrets engine because it enables applications to offload cryptographic operations to Vault while keeping encryption keys protected inside Vault. This matches the scenario exactly: the app needs to encrypt and decrypt sensitive values and generate HMACs, but should not directly access key material. In Vault documentation, transit is described as "encryption as a service" and is commonly used for protecting application data, tokenization-style workflows, signing, and HMAC generation. By contrast, KV stores secrets, database manages database credentials, and PKI manages certificates. A key exam takeaway is that transit is for performing cryptographic operations without exposing keys to clients.
- A. Correct.
Correct. The transit secrets engine is designed for cryptographic operations such as encryption, decryption, signing, verification, and HMAC generation without requiring the client to access the underlying key material. This is a common pattern when applications must protect sensitive data but security teams want keys to remain inside Vault.
- B. Incorrect.
Incorrect. KV is for storing arbitrary secrets, not performing cryptographic operations on behalf of applications. While a team could store a key in KV, that would require the application to retrieve and handle the key itself, which conflicts with the requirement to avoid exposing raw encryption keys to application servers.
- C. Incorrect.
Incorrect. The database secrets engine is used to generate and manage database credentials, often dynamic ones, for supported databases. It does not provide general-purpose application-layer encryption, decryption, or HMAC services for arbitrary payloads.
- D. Incorrect.
Incorrect. The PKI secrets engine issues and manages certificates and related private keys for TLS and other certificate-based use cases. Although PKI supports cryptographic identity and trust, it is not the appropriate engine for field-level encryption of application data stored in a database.