HashiCorp Vault Associate (003) Question 165
Single answer6 Encryption as a serviceA security team wants several internal applications to protect customer identifiers without storing encryption keys in the applications themselves. The applications only need to encrypt and decrypt specific fields, and the team wants key rotation to occur in Vault without forcing the applications to re-encrypt all previously stored data immediately. Which Vault approach best meets these requirements?
- A
Use the Transit secrets engine so applications send plaintext to Vault for encryption/decryption operations while Vault manages the keys and key versions.
- B
Use the KV secrets engine to store a shared AES key, and have each application retrieve the key and perform encryption locally.
- C
Use the PKI secrets engine to issue certificates and use those certificates directly to encrypt customer identifiers in the application database.
- D
Use response wrapping to deliver a one-time encryption key to each application instance, and let the instances manage future encryption and rotation themselves.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use the Transit secrets engine. Transit is designed specifically for encryption as a service: Vault performs cryptographic functions while keeping key material inside Vault. This pattern is commonly used for encrypting application fields, tokens, or identifiers when teams want centralized key management and auditability. A key advantage is that Transit supports key rotation by maintaining key versions; new encryption operations use the latest version, while existing ciphertext encrypted with older versions can still be decrypted. This aligns with the requirement to rotate keys in Vault without forcing immediate re-encryption of all historical data. By contrast, the KV secrets engine stores arbitrary secrets but does not perform cryptographic operations, PKI is for certificate issuance and management rather than symmetric data encryption, and response wrapping is only for secure secret delivery. These distinctions are consistent with HashiCorp Vault documentation for the Transit, KV, and PKI secrets engines and with Vault best practices for centralized cryptographic services.
- A. Correct.
Correct. The Transit secrets engine is Vault's encryption-as-a-service feature. Applications do not need direct access to key material; instead, they call Vault to encrypt and decrypt data. Transit supports key rotation through key versions, and older ciphertext can still be decrypted with the appropriate prior key version. This allows rotation in Vault without requiring an immediate bulk re-encryption of existing data.
- B. Incorrect.
Incorrect. While storing an AES key in KV is possible, it defeats the main requirement of avoiding key storage in the applications. The applications would retrieve raw key material and become responsible for cryptographic operations, key handling, and secure rotation logic. This is a common misconception: KV stores secrets, but it is not an encryption-as-a-service workflow.
- C. Incorrect.
Incorrect. The PKI secrets engine is used for issuing and managing certificates and private keys for TLS and identity-related use cases. It is not the correct mechanism for application field encryption of database values through Vault-managed symmetric encryption operations. Someone might choose this option because PKI is related to cryptography, but its purpose is different from Transit.
- D. Incorrect.
Incorrect. Response wrapping is a secure delivery mechanism for secrets, not an encryption service and not a key lifecycle strategy for application-managed encryption. If applications receive one-time keys and then manage encryption themselves, the burden of key protection and rotation shifts back to the applications, which does not meet the stated goal.