HashiCorp Vault Associate (003) Question 171
Single answer6a Encrypt and decrypt secretsA security team wants an internal application to protect customer SSNs without storing encryption keys in the application or database. The application must be able to submit plaintext to Vault, store only the encrypted value, and later request the original plaintext when an authorized workflow needs it. Which Vault approach best meets this requirement?
- A
Enable the Transit secrets engine, create an encryption key, and have the application call the encrypt and decrypt endpoints.
- B
Store the SSNs as key/value secrets in the KV secrets engine and rely on Vault's storage encryption to protect them.
- C
Use the PKI secrets engine to issue certificates and use those certificates directly to encrypt and decrypt SSNs through Vault.
- D
Use response wrapping so the application can wrap SSNs before storing them and unwrap them later to recover the plaintext.
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use the Transit secrets engine. Transit provides cryptographic functions such as encrypt, decrypt, rewrap, sign, and verify while keeping key material inside Vault. This is the recommended Vault pattern when an application needs to protect sensitive values like SSNs but should not manage encryption keys itself. By contrast, KV stores secrets in Vault, PKI manages certificates, and response wrapping is for secure secret delivery rather than data encryption. This aligns with Vault documentation and best practices for 'encryption as a service' using the Transit secrets engine.
- A. Correct.
Correct. The Transit secrets engine is designed for encryption-as-a-service. Applications send plaintext to Vault's transit encrypt endpoint, store the returned ciphertext externally, and later call the decrypt endpoint when permitted. The encryption keys remain in Vault and are never exposed to the application, which matches the requirement.
- B. Incorrect.
Incorrect. KV is for storing secrets, not for performing cryptographic operations on application data. While Vault encrypts data at rest in its storage backend, that does not help an application encrypt values before storing them in its own database. This option reflects a common misunderstanding between Vault's internal storage protection and the Transit engine's application-facing encryption features.
- C. Incorrect.
Incorrect. The PKI secrets engine issues and manages X.509 certificates for TLS and related identity use cases. It is not the standard mechanism for applications to send arbitrary plaintext to Vault and get ciphertext back for symmetric encryption/decryption workflows like protecting SSNs in a database.
- D. Incorrect.
Incorrect. Response wrapping is used to securely deliver a secret or token by wrapping it in a single-use token for later unwrapping. It is not a general-purpose encryption service for application data at rest. Someone might choose this because 'wrapping' sounds like encryption, but it solves a different problem.