HashiCorp Vault Associate (003) Question 167
Single answer6 Encryption as a serviceA development team wants to protect customer account numbers used by several internal applications. They do not want Vault to store the original values, but they need applications to send plaintext to Vault, receive a protected value, and later retrieve the original value when needed. They also want the ability to rotate the encryption key without re-encrypting all previously stored ciphertext immediately. Which Vault feature should they use?
- A
Enable the Transit secrets engine and use its encrypt and decrypt APIs with key rotation
- B
Enable the KV v2 secrets engine and store the plaintext account numbers as versioned secrets
- C
Use the Cubbyhole secrets engine so each application can write plaintext and Vault will encrypt it automatically
- D
Use the PKI secrets engine to issue certificates for each application and rely on the certificates to protect account numbers at rest
Show answer and explanation
Correct answer: A
Explanation
The correct answer is the Transit secrets engine. In Vault, Transit is specifically designed for encryption as a service, allowing applications to offload cryptographic operations to Vault without storing the source plaintext in the secrets engine. This matches the scenario's requirement to protect sensitive values while avoiding plaintext storage in Vault. Transit also supports key rotation and key versioning, so previously encrypted ciphertext remains decryptable with older key versions after a rotation. That makes it well suited for real-world application encryption workflows where immediate re-encryption of all historical data is impractical. By contrast, KV v2 is for storing secrets, Cubbyhole is for token-scoped storage, and PKI is for certificate management rather than encrypting arbitrary data. These distinctions are consistent with HashiCorp Vault documentation and common best practices for selecting the appropriate secrets engine for the job.
- A. Correct.
Correct. The Transit secrets engine provides encryption as a service: applications send data to Vault for encryption/decryption, while Vault does not persist the plaintext being protected. Transit supports key rotation and can decrypt data encrypted with older key versions, which lets teams rotate keys without immediately re-encrypting all existing ciphertext. This is the standard Vault approach for application-level encryption workflows.
- B. Incorrect.
Incorrect. KV v2 is for storing secrets in Vault with versioning, not for providing cryptographic operations as a service. In this scenario, the team explicitly does not want Vault to store the original account numbers, so KV v2 does not meet the requirement.
- C. Incorrect.
Incorrect. Cubbyhole is a per-token private storage backend, useful for short-lived or token-scoped secret storage patterns, not for encryption as a service. It does not automatically encrypt application data on behalf of clients in the way Transit does.
- D. Incorrect.
Incorrect. The PKI secrets engine issues and manages certificates and private keys for TLS or identity use cases. Certificates can help secure transport between systems, but PKI is not the feature used to encrypt arbitrary application data such as customer account numbers for later decryption.