HashiCorp Vault Associate (003) Question 166
Single answer6 Encryption as a serviceA development team wants to store customer records in a shared database while keeping sensitive fields unreadable to database administrators. The application must be able to encrypt and decrypt values without Vault storing the plaintext data itself. The security team also wants the ability to rotate encryption keys over time and rewrap existing ciphertext when needed. Which Vault solution best fits these requirements?
- A
Use the Transit secrets engine so the application sends data to Vault for encryption and decryption while Vault manages the encryption keys
- B
Use the KV secrets engine version 2 so the application can store encrypted values in Vault and retrieve them later for transparent database encryption
- C
Use the PKI secrets engine so the application can issue short-lived certificates and use them directly to encrypt database fields
- D
Use response wrapping so customer records are wrapped before being written to the database, and unwrap them when the application reads them back
Show answer and explanation
Correct answer: A
Explanation
The best answer is the Transit secrets engine. In Vault, Transit is the feature commonly described as encryption as a service: Vault performs cryptographic functions on behalf of applications while keeping key material centrally managed and inaccessible to the application or database administrators. This is especially appropriate for protecting sensitive fields stored in external systems. Transit also supports operational needs such as key rotation and rewrap, allowing ciphertext to be updated to newer key versions without exposing plaintext unnecessarily. By contrast, KV is for secret storage, PKI is for certificate issuance and management, and response wrapping is for secure secret delivery rather than persistent encryption of business data. These distinctions are consistent with HashiCorp Vault documentation and recommended usage patterns for the Transit secrets engine.
- A. Correct.
Correct. The Transit secrets engine provides encryption as a service. Applications send plaintext to Vault for encryption and can later send ciphertext for decryption, while Vault retains and manages the encryption keys rather than the application. This is specifically designed for cases where data is stored elsewhere, such as a database, but encryption operations and key lifecycle management are centralized in Vault. Transit also supports key rotation and rewrapping ciphertext to newer key versions, which directly matches the scenario.
- B. Incorrect.
Incorrect. KV v2 is for storing secrets in Vault, with versioning and metadata, but it is not an encryption-as-a-service solution for application-managed data stored outside Vault. A common misconception is that because Vault stores secrets securely, KV can be used like field-level encryption for external databases. In this scenario, the requirement is for Vault to perform cryptographic operations without storing the customer records themselves, which is what Transit is built for.
- C. Incorrect.
Incorrect. The PKI secrets engine issues and manages X.509 certificates and related material. It is used for TLS, mTLS, and certificate-based identity workflows, not for encrypting arbitrary application fields in a database. Someone might choose this option because PKI involves cryptography, but certificate issuance is not the same as application-layer encryption of stored data.
- D. Incorrect.
Incorrect. Response wrapping is a secure delivery mechanism for secrets, using a single-use wrapping token so a recipient can unwrap a secret later. It is not intended as a persistent encryption mechanism for application data stored in a database. A candidate might confuse wrapping with encryption because both protect data in transit, but wrapping does not provide the key management and re-encryption workflow needed for long-term stored customer records.