HashiCorp Vault Associate (003) Question 169
Single answer6 Encryption as a serviceA development team wants several internal applications to protect customer account numbers without storing encryption keys in the applications themselves. The applications must be able to encrypt and decrypt values through Vault, and the security team wants the option to rotate keys periodically without requiring the applications to re-encrypt all previously stored data immediately. Which Vault approach best meets these requirements?
- A
Enable the Transit secrets engine and have the applications call its encrypt and decrypt APIs using a named key.
- B
Store a static AES key in KV v2 and have each application read the key and perform encryption locally.
- C
Use the Database secrets engine so Vault can generate short-lived credentials and encrypt the account numbers before writing them to the database.
- D
Use response wrapping so the wrapped token itself becomes the encrypted form of the customer account number.
Show answer and explanation
Correct answer: A
Explanation
The best solution is the Transit secrets engine, which is specifically designed for encryption as a service in Vault. With Transit, applications do not need direct access to key material; they use Vault APIs to perform cryptographic operations. This is a common pattern for protecting sensitive fields such as account numbers, API tokens, or personally identifiable information. Transit also supports key rotation through key versions, allowing teams to rotate keys on a schedule while still decrypting older ciphertext generated under previous versions. This directly addresses the operational requirement to avoid an immediate bulk re-encryption event. HashiCorp documentation describes Transit as an engine for cryptographic functions including encrypt/decrypt and key rotation, while KV is a storage engine for secrets, Database manages database credentials, and response wrapping is for secure secret delivery rather than field-level encryption.
- A. Correct.
Correct. The Transit secrets engine is Vault's encryption-as-a-service feature. Applications send plaintext to Vault for encryption and ciphertext to Vault for decryption, while the key material remains in Vault. Transit supports key rotation and versioned keys, which allows new encrypt operations to use the latest key version while older ciphertext can still be decrypted with prior versions. This matches the requirement to rotate keys without immediately re-encrypting all historical data.
- B. Incorrect.
Incorrect. KV v2 is for storing secrets, not for providing encryption-as-a-service. If applications read a static AES key from KV and encrypt locally, the key leaves Vault and must be handled securely by every application. That increases key exposure and operational risk, and it does not provide the same centralized cryptographic controls as Transit.
- C. Incorrect.
Incorrect. The Database secrets engine is used to generate and manage database credentials, typically dynamic credentials, not to perform application-layer encryption of arbitrary values. A candidate might choose this because the scenario mentions data stored in a database, but this engine does not encrypt application payloads such as customer account numbers.
- D. Incorrect.
Incorrect. Response wrapping is a secure delivery mechanism for Vault secrets, using a single-use wrapping token. It is not a data encryption service for arbitrary application fields. Someone might confuse wrapping with encryption because wrapped responses conceal secret values until unwrapped, but wrapped tokens are not a substitute for encrypting and decrypting customer data.