HashiCorp Vault Associate (003) Question 168
Single answer6 Encryption as a serviceA development team needs an application to store customer records in a database while keeping sensitive fields unreadable to database administrators. The application must be able to encrypt and decrypt values on demand, and the security team wants to rotate keys periodically without re-encrypting all existing data immediately. Which Vault approach best meets these requirements?
- A
Enable the Transit secrets engine and have the application call Vault to encrypt and decrypt the sensitive fields, using key rotation when needed
- B
Enable the KV v2 secrets engine and store the customer records there so Vault automatically encrypts and decrypts fields for the database
- C
Use the database secrets engine to generate dynamic database credentials, which will also encrypt the application data before it is written
- D
Use the PKI secrets engine to issue certificates to the application and rely on TLS alone to keep the database fields unreadable at rest
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use the Transit secrets engine. In Vault, Transit is designed specifically for Encryption as a Service, allowing applications to send plaintext to Vault for encryption and ciphertext for decryption, while Vault manages the cryptographic keys centrally. This pattern is appropriate when an application must store encrypted values in an external system such as a relational database. It also supports operational needs such as key rotation without requiring immediate bulk re-encryption of all previously stored data, because Vault can decrypt ciphertext generated with older key versions. By contrast, KV v2 stores secrets in Vault, the database secrets engine manages credentials, and PKI provides certificates for TLS rather than field-level encryption. These distinctions align with HashiCorp Vault documentation and best practices for choosing the correct secrets engine for the job.
- A. Correct.
Correct. The Transit secrets engine provides Encryption as a Service: Vault performs cryptographic operations on data without storing the underlying plaintext application records. This is a common pattern for encrypting sensitive fields before storing them in an external database. Transit supports key rotation, and old ciphertext can still be decrypted because Vault retains key versions for decryption unless configured otherwise. This meets the requirement to rotate keys without immediately re-encrypting all stored data.
- B. Incorrect.
Incorrect. KV v2 is a versioned key-value storage engine for storing secrets in Vault, not an encryption service for application data in an external database. While Vault encrypts data at rest internally, KV v2 does not provide the application-facing encrypt/decrypt API needed to protect selected database fields.
- C. Incorrect.
Incorrect. The database secrets engine is used primarily for generating dynamic or static database credentials and managing database access, not for encrypting application payloads. A candidate might choose this because it relates to databases, but it solves authentication to the database rather than field-level encryption of stored records.
- D. Incorrect.
Incorrect. The PKI secrets engine issues certificates and supports TLS use cases such as securing communication in transit. TLS protects data between systems, but it does not make individual database fields unreadable to a database administrator once the data is stored. The requirement is about encryption of data at rest under application control, which is what Transit addresses.