HashiCorp Vault Associate (003) Question 136
Single answer5c Describe the uses of transit secrets engineA development team is building a payment application that must protect cardholder data. Company policy does not allow application servers to store encryption keys locally, but the application still needs to encrypt sensitive values before writing them to its database. The security team also wants the ability to decrypt older records after key rotation without exporting key material from Vault. Which Vault feature is the best fit for this requirement?
- A
Use the transit secrets engine so the application sends plaintext to Vault for encryption and stores only the returned ciphertext, while Vault manages key rotation and key versions internally
- B
Use the KV secrets engine so the application can store the encryption key in Vault and retrieve it each time it needs to encrypt data locally
- C
Use the PKI secrets engine to issue a certificate for the application and use that certificate as the database encryption key
- D
Use response wrapping so the application can wrap plaintext before storing it in the database without needing encryption keys
Show answer and explanation
Correct answer: A
Explanation
The transit secrets engine is the appropriate choice when applications need cryptographic functions such as encrypt, decrypt, sign, verify, and key rotation without direct access to the underlying key material. This is often described as encryption as a service. In this scenario, the application can send sensitive data to Vault's transit engine, store only the ciphertext in the database, and rely on Vault-managed key versions to continue decrypting older data after rotation. By contrast, KV is for secret storage, PKI is for certificate issuance and management, and response wrapping is for secure secret delivery rather than field-level encryption. This aligns with HashiCorp Vault documentation and best practices for using transit to protect application data while keeping key material centralized and non-exported.
- A. Correct.
Correct. The transit secrets engine is designed for encryption-as-a-service and related cryptographic operations. Applications send data to Vault to be encrypted or decrypted without ever handling the underlying key material directly. Transit supports key rotation and key versioning, so previously encrypted data can still be decrypted using the correct key version, which matches the scenario requirements.
- B. Incorrect.
Incorrect. The KV secrets engine stores arbitrary secrets such as API keys, passwords, or configuration values, but it is not intended to perform cryptographic operations on behalf of applications. Retrieving an encryption key from KV would expose key material to the application, which violates the stated policy.
- C. Incorrect.
Incorrect. The PKI secrets engine issues and manages X.509 certificates for TLS and identity use cases. It is not used as a service for application data encryption in a database, and a certificate is not a substitute for the symmetric encryption workflow described in this scenario.
- D. Incorrect.
Incorrect. Response wrapping is a secure delivery mechanism for secrets, not a data encryption feature for application records. It helps protect secret transmission and short-lived access, but it does not replace the transit engine for encrypting and decrypting database fields.