HashiCorp Vault Associate (003) Question 138
Single answer5c Describe the uses of transit secrets engineA development team is building a payment application that must protect sensitive cardholder data. Security policy requires that encryption keys never be exposed to the application servers, but the application still needs to encrypt and decrypt specific fields in the database. The team also wants to generate HMACs for message integrity checks without storing cryptographic key material in the app. Which Vault feature best meets these requirements?
- A
Use the transit secrets engine so the application sends plaintext to Vault for cryptographic operations while Vault manages the keys
- B
Use the KV secrets engine so the application can read an encryption key from Vault and perform all cryptographic operations locally
- C
Use the database secrets engine to generate dynamic database credentials, which also encrypts application data before it is written
- D
Use response wrapping so the application can unwrap a key once and reuse it for encryption and HMAC operations
Show answer and explanation
Correct answer: A
Explanation
The transit secrets engine is commonly described as 'encryption as a service.' It allows applications to offload cryptographic operations to Vault so that key material remains inside Vault and is never returned to clients. This makes it well suited for field-level encryption, tokenization-related workflows, signing, verification, and HMAC generation in real-world applications. By contrast, the KV secrets engine stores secrets for retrieval, the database secrets engine issues database credentials, and response wrapping protects secret delivery rather than providing cryptographic services. According to Vault documentation and best practices, transit is the correct choice when an application needs cryptographic operations performed with centrally managed keys that are not exposed to application code or infrastructure.
- A. Correct.
Correct. The transit secrets engine is designed for cryptographic functions such as encrypt, decrypt, sign, verify, and HMAC generation without requiring the calling application to access the underlying key material. This matches the scenario's requirement that keys must not be exposed to application servers while still allowing field-level encryption and integrity operations.
- B. Incorrect.
Incorrect. The KV secrets engine stores arbitrary secrets, including keys, but if the application reads the key and performs encryption locally, the key is exposed to the application server. That directly violates the stated security requirement. This is a common misconception because both KV and transit deal with sensitive data, but KV is for secret storage, not managed cryptographic operations.
- C. Incorrect.
Incorrect. The database secrets engine provides dynamic database credentials and related database secret management. It does not perform application-layer encryption or HMAC generation for arbitrary data fields. Someone might choose this option because the scenario mentions a database, but the need is cryptographic processing, not database credential management.
- D. Incorrect.
Incorrect. Response wrapping is a secure delivery mechanism for secrets, not a cryptographic engine. It can protect a secret in transit by requiring unwrapping, but it does not replace encryption, decryption, or HMAC functions. Reusing an unwrapped key in the application would again expose key material to the app, which the scenario explicitly forbids.