HashiCorp Vault Associate (003) Question 175
Single answer6b Rotate the encryption keyA security team requires a periodic rotation of the key Vault uses to encrypt data at rest. An operator is asked to rotate this key on a production Vault cluster without changing the unseal mechanism or re-encrypting all existing data immediately. Which action should the operator take?
- A
Run the operator command to rotate the encryption key used by the keyring, which creates a new active key for future writes while preserving older keys for reading existing data
- B
Generate a new set of unseal keys with rekey, because rekey replaces the encryption key that protects all stored data
- C
Seal and unseal the cluster repeatedly until Vault automatically derives a new barrier encryption key from the existing unseal keys
- D
Disable and re-enable the storage backend so Vault reinitializes storage with a freshly generated encryption key
Show answer and explanation
Correct answer: A
Explanation
For Vault Associate-level knowledge, it is important to distinguish between rotating the encryption key for data at rest and rekeying unseal or recovery keys. Vault supports rotating the active encryption key in its keyring using the operator rotate functionality. After rotation, new data is encrypted with the new key version, while previous key versions remain available to decrypt older entries. This avoids the need to re-encrypt all stored data immediately and does not change the seal or unseal configuration. By contrast, rekey changes unseal or recovery key shares and is used for operational control of access to unseal, not for rotating the data encryption key. This behavior aligns with Vault operator lifecycle and key management best practices documented in HashiCorp Vault's operator and seal/key rotation documentation.
- A. Correct.
Correct. In Vault, rotating the encryption key for data at rest is done with the operator rotate action (for example, via the CLI or API). This rotates the active key in the keyring used to encrypt new writes. Existing data does not need to be immediately rewritten; Vault retains older key versions so it can still decrypt data written with previous keys. This is the practical and intended method for rotating the barrier/encryption key without changing the unseal method.
- B. Incorrect.
Incorrect. Rekey changes the unseal keys or recovery keys depending on the seal type; it does not rotate the encryption key used to encrypt stored data at rest. A common misconception is to equate unseal keys with the data encryption key, but in Vault they serve different purposes. Rekey affects how Vault is unsealed, not the active encryption key used by the keyring.
- C. Incorrect.
Incorrect. Sealing and unsealing does not rotate the encryption key automatically. Those operations lock and unlock access to the existing key material; they do not create a new active encryption key version. Someone might choose this if they assume the barrier key is regenerated during unseal, but that is not how Vault works.
- D. Incorrect.
Incorrect. Storage backends are not rotated this way, and disabling or re-enabling storage is not a valid method for key rotation in Vault. This would also be operationally disruptive and risks service impact. The storage backend holds encrypted data; Vault's operator-driven key rotation handles the encryption key lifecycle.