HashiCorp Vault Associate (003) Question 177
Single answer6b Rotate the encryption keyYour team suspects that an old unseal key share may have been exposed during an incident review. Vault is currently unsealed and operating normally, and you need to change the key material used to protect the root key without reinitializing the cluster or affecting stored secrets. Which action should you take?
- A
Run the rekey operation to generate a new set of unseal keys
- B
Rotate the root token so Vault re-encrypts the keyring with a new token
- C
Enable seal wrapping on all mounts so the existing unseal keys are replaced automatically
- D
Rotate the encryption key for the transit secrets engine used by applications
Show answer and explanation
Correct answer: A
Explanation
For Vault Associate-level objectives, 'rotate the encryption key' in practice often maps to knowing when and how to rekey Vault's unseal keys after suspected exposure. Rekeying lets operators generate a new set of key shares for the same Vault cluster without reinitializing or losing data. This is the correct operational response when the concern is that existing unseal key shares may be compromised. By contrast, rotating the root token affects privileged access, not storage encryption; rotating a transit key affects application-facing encryption only; and seal wrapping is unrelated to replacing unseal key shares. HashiCorp documentation distinguishes these concepts clearly: rekey rotates unseal/recovery key material, while key rotation in secrets engines such as transit applies only to those engines' managed encryption keys.
- A. Correct.
Correct. Rekeying changes the unseal key shares used to reconstruct the master key that protects Vault's root key, without reinitializing Vault or deleting data. In a real incident where an unseal key share might be compromised, the appropriate response is to perform a rekey operation so the old shares are no longer valid.
- B. Incorrect.
Incorrect. The root token is an authentication credential, not the mechanism that encrypts Vault's internal keyring or storage barrier. Rotating or revoking the root token is a separate security action and does not replace unseal key shares.
- C. Incorrect.
Incorrect. Seal wrapping is an enterprise security feature that provides additional protection for certain stored values, but it does not automatically regenerate or replace unseal keys. It addresses a different layer of protection than rekeying.
- D. Incorrect.
Incorrect. Rotating a transit key affects encryption operations for that specific transit key used by clients, not Vault's own barrier encryption or unseal process. This is a common confusion between application data encryption managed by a secrets engine and Vault's internal encryption/key protection mechanisms.