HashiCorp Vault Associate (003) Question 139
Single answer5c Describe the uses of transit secrets engineA development team is building a payment application that must protect cardholder data. Security policy requires that encryption keys never leave Vault, but the application still needs to encrypt sensitive values before storing them in its database and occasionally generate HMACs to verify message integrity between services. The team does not want Vault to store the application data itself. Which Vault capability is the best fit for this requirement?
- A
Use the transit secrets engine so the application sends plaintext to Vault for cryptographic operations while Vault keeps the encryption keys
- B
Use the KV secrets engine so the application can store plaintext in Vault and retrieve it later when it needs to encrypt data locally
- C
Use the database secrets engine so Vault can encrypt cardholder data and create HMACs before writing records to the database
- D
Use response wrapping so the application can wrap cardholder data and unwrap it later instead of encrypting it
Show answer and explanation
Correct answer: A
Explanation
The best answer is the transit secrets engine because it provides cryptographic functions without requiring Vault to persist the sensitive application data. This is a common real-world use case: encrypting data before storage, decrypting when needed, and generating HMACs or signatures while keeping key material centralized and protected inside Vault. In HashiCorp Vault documentation, transit is described as an encryption-as-a-service engine that supports operations including encrypt/decrypt, rewrap, sign/verify, and HMAC. By contrast, KV stores secrets, database manages database credentials, and response wrapping securely delivers secret responses but does not replace encryption of business data.
- A. Correct.
Correct. The transit secrets engine is designed for encryption as a service. Applications send data to Vault for cryptographic operations such as encrypt, decrypt, rewrap, sign, verify, and HMAC generation, while the underlying keys remain in Vault. This matches the scenario exactly because the application needs cryptographic services without Vault storing the cardholder data itself.
- B. Incorrect.
Incorrect. The KV secrets engine is for storing and retrieving arbitrary secrets, not for performing cryptographic operations on application data. Using KV would also conflict with the requirement that Vault should not store the application data itself. A common misconception is that any secret-related need should use KV, but transit is the appropriate engine for crypto operations.
- C. Incorrect.
Incorrect. The database secrets engine is used to generate and manage dynamic database credentials and, in some cases, rotate static credentials. It does not provide general-purpose encryption or HMAC services for application payloads. This distractor targets confusion between protecting access to a database and encrypting the data stored in it.
- D. Incorrect.
Incorrect. Response wrapping is used to securely deliver Vault secrets by wrapping a response in a single-use token for later unwrapping. It is not a substitute for application-layer encryption or message integrity operations such as HMAC generation. Someone might choose this if they misunderstand wrapping as a general encryption mechanism.