HashiCorp Vault Associate (003) Question 179
Single answer6b Rotate the encryption keyA security team requires periodic rotation of the key that Vault uses to encrypt data at rest. A Vault administrator wants to perform this change with minimal disruption and without making existing secrets unreadable. Which action should the administrator take?
- A
Run
vault operator rotateto generate a new encryption key for the keyring so future writes use the new key while Vault can still decrypt existing data with older keys. - B
Run
vault operator rekeyto replace the storage encryption key used for all persisted data and automatically re-encrypt every stored secret in place. - C
Disable and re-enable the secrets engines so that each engine generates a fresh encryption key for Vault's storage backend.
- D
Rotate the unseal keys by generating a new set of recovery keys, because the unseal or recovery keys are the same keys used to encrypt all data at rest.
Show answer and explanation
Correct answer: A
Explanation
The correct command for rotating Vault's encryption key at rest is vault operator rotate. In Vault terminology, this rotates the barrier encryption key in the keyring. Vault retains previous key versions so it can continue to decrypt existing data, while new writes use the latest key version. This makes key rotation operationally safe and minimizes disruption. A common misconception is confusing rotate with rekey: vault operator rekey changes unseal key shares, not the barrier encryption key. Similarly, changing recovery keys or secrets engine configuration does not rotate the core encryption key used for storage. This aligns with Vault operator workflows and HashiCorp documentation on key rotation and rekey operations.
- A. Correct.
Correct.
vault operator rotaterotates Vault's internal encryption keyring used for the barrier encryption key. After rotation, new writes are encrypted with the newest key, while older keys remain in the keyring so Vault can still decrypt previously written data. This is the correct operation when the goal is to rotate the encryption key protecting data at rest without breaking access to existing data. - B. Incorrect.
Incorrect.
vault operator rekeychanges the unseal key shares, not the data encryption key used for storage. Rekey is used to generate a new set of unseal keys under Shamir seal or to change share/threshold settings. It does not perform the barrier key rotation described in the scenario, and it does not re-encrypt all stored data in place the way this option suggests. - C. Incorrect.
Incorrect. Secrets engines are not the mechanism for rotating Vault's core storage encryption key. Disabling and re-enabling engines can disrupt access and may remove configuration or data depending on the engine and workflow. It does not rotate the barrier encryption key that Vault uses to protect persisted data in storage.
- D. Incorrect.
Incorrect. Unseal keys or recovery keys are not the same as the encryption key that directly encrypts Vault's stored data. They are involved in unsealing or recovery workflows depending on the seal type. Rotating them does not rotate the keyring used for barrier encryption of data at rest, so this would not satisfy the requirement.