HashiCorp Vault Associate (003) Question 137
Single answer5c Describe the uses of transit secrets engineA development team is building a payment application that must protect sensitive cardholder data. Security policy prohibits application servers from storing encryption keys locally, but the application still needs to encrypt and decrypt specific fields before writing them to its database. The team also wants the ability to rotate cryptographic keys without re-architecting the application. Which Vault feature is the best fit for this requirement?
- A
Use the transit secrets engine so the application sends data to Vault for encryption and decryption while Vault manages the keys
- B
Use the KV secrets engine so the application can read a static AES key from Vault and perform all encryption locally
- C
Use the database secrets engine so Vault can encrypt the cardholder data before it is stored in the database
- D
Use response wrapping so the application can wrap plaintext cardholder data before storing it in the database
Show answer and explanation
Correct answer: A
Explanation
The transit secrets engine is intended for cryptographic operations on data without requiring the client to manage the underlying encryption keys. This makes it well suited for applications that need to encrypt/decrypt sensitive fields while keeping key material centralized in Vault. In practice, transit is commonly used for encryption as a service, decryption, key rotation, and related cryptographic operations such as signing or hashing depending on the use case. By contrast, the KV secrets engine stores secrets but does not perform cryptographic operations for the client; the database secrets engine manages database credentials; and response wrapping protects secret delivery, not stored application data. HashiCorp documentation describes transit as a secrets engine for cryptographic functions where Vault manages named encryption keys and performs encryption/decryption operations on behalf of clients.
- A. Correct.
Correct. The transit secrets engine is designed for encryption-as-a-service. Applications send plaintext to Vault to encrypt, or ciphertext to decrypt, and the key material remains managed by Vault rather than being exposed to the application. This is a common real-world use case for protecting application data such as card numbers, API tokens, or other sensitive fields. Transit also supports key rotation, which helps meet the requirement to rotate cryptographic keys without redesigning the application.
- B. Incorrect.
Incorrect. KV is used to store and retrieve arbitrary secrets, such as configuration values, API keys, or even a manually stored encryption key. However, if the application retrieves the AES key and encrypts locally, the key leaves Vault and is exposed to the application environment, which violates the stated policy. This option reflects a common misconception that any secret stored in Vault automatically provides the same protection as transit.
- C. Incorrect.
Incorrect. The database secrets engine is used to generate and manage database credentials, typically dynamic usernames and passwords, not to encrypt arbitrary application data fields. It helps control database access, but it does not provide application-layer encryption for cardholder data.
- D. Incorrect.
Incorrect. Response wrapping is used to securely deliver a secret by wrapping it in a single-use token for later unwrapping. It is not a mechanism for encrypting application data at rest in a database. Someone might choose this if they confuse secure secret delivery with cryptographic protection of stored business data.