HashiCorp Vault Associate (003) Question 176
Single answer6b Rotate the encryption keyA security team requires that the Vault cluster's encryption key for the storage backend be rotated on a regular schedule. The team wants to perform the rotation with minimal operational impact and without changing the unseal keys. Which action should the operator take?
- A
Run
vault operator rotateon the active Vault node to rotate the data encryption key used by the storage backend - B
Run
vault operator rekeyso Vault generates a new encryption key for stored data and new unseal keys at the same time - C
Seal and reinitialize the cluster so Vault creates a fresh master key and re-encrypts existing secrets automatically
- D
Enable a new transit key and configure Vault to use it as the storage encryption key for the integrated storage backend
Show answer and explanation
Correct answer: A
Explanation
The correct operational step is to use vault operator rotate, which rotates the key Vault uses to encrypt data at rest in its storage barrier. This is distinct from vault operator rekey, which rotates unseal or recovery key shares and is often a source of confusion for candidates. For Vault Associate-level knowledge, it is important to distinguish between barrier key rotation and rekey operations. Best practice is to rotate the encryption key using the dedicated operator command during planned maintenance procedures, while understanding that this does not change the unseal keys. See the Vault operator command documentation for rotate and rekey, and the documentation on sealing, unsealing, and key management.
- A. Correct.
Correct.
vault operator rotaterotates Vault's encryption key used to protect data in storage. This is the operational command intended for routine encryption key rotation. It does not rotate unseal keys, so it satisfies the requirement to rotate the storage encryption key without changing unseal material. - B. Incorrect.
Incorrect.
vault operator rekeychanges the unseal keys or recovery keys threshold/shares, depending on seal type and configuration. It is commonly confused with encryption key rotation because both are security-sensitive operations, but rekeying does not perform the routine rotation of the storage encryption key in the way described here. - C. Incorrect.
Incorrect. Reinitializing the cluster is destructive and operationally disruptive. Initialization is for creating a brand-new Vault, not for regular encryption key rotation. Existing data would not be preserved through a reinitialization process unless restored separately, so this is not an appropriate or minimal-impact approach.
- D. Incorrect.
Incorrect. Transit keys are used with the Transit secrets engine for cryptographic operations requested by clients, not as a direct replacement command for rotating Vault's internal storage encryption key in this scenario. This option mixes up application-level encryption features with Vault's internal barrier/storage encryption process.