HashiCorp Vault Associate (003) Question 178
Single answer6b Rotate the encryption keyA security team requires that the key used to encrypt data stored by Vault be rotated as part of a routine compliance process. The Vault cluster is healthy and unsealed, and the team wants to rotate the key without changing the unseal keys or reinitializing the cluster. Which action should the Vault administrator take?
- A
Run
vault operator rekeyto generate a new barrier encryption key and new unseal keys at the same time - B
Run
vault operator rotateto rotate Vault's encryption key used for the keyring that protects stored data - C
Run
vault operator initagain so Vault creates a fresh encryption key for the existing cluster - D
Seal and unseal all nodes, because Vault automatically rotates the encryption key during the next unseal operation
Show answer and explanation
Correct answer: B
Explanation
In Vault, rotating the encryption key that protects stored data is a distinct operational task from rekeying unseal shares. For this scenario, the administrator should use vault operator rotate. This creates a new active key term in Vault's keyring for encrypting newly written data while preserving the ability to decrypt existing data encrypted under older terms. By contrast, vault operator rekey changes unseal or recovery key shares and does not rotate the storage encryption key. Reinitializing with vault operator init is only for first-time setup of a new cluster. HashiCorp Vault documentation distinguishes these operations clearly: initialization sets up Vault, rekey changes unseal-related shares, and rotate changes the active encryption key used by the barrier/keyring for stored data.
- A. Incorrect.
vault operator rekeyis not the correct action here. Rekey changes the unseal/recovery key shares used to authorize unsealing or recovery operations; it does not rotate the barrier encryption key that Vault uses to protect persisted data. This is a common confusion because both operations involve key material, but they affect different parts of Vault's security model. - B. Correct.
This is correct.
vault operator rotaterotates Vault's encryption key by adding a new key term to the keyring and making the new key active for future encryption operations. This is the appropriate command when the goal is to rotate the key used to encrypt stored data without reinitializing the cluster or changing unseal keys. - C. Incorrect.
vault operator initis only used when initializing a brand-new Vault cluster. Running initialization again on an existing initialized cluster is not how key rotation works and would indicate a misunderstanding of Vault's lifecycle. Initialization creates the initial root key material and unseal shares; it is not a maintenance operation for an active cluster. - D. Incorrect.
Sealing and unsealing do not automatically rotate the encryption key. Those actions only lock and unlock access to the existing barrier key material. An administrator must explicitly invoke key rotation with the appropriate operator command. This distractor reflects the misconception that unseal events regenerate encryption keys.