HashiCorp Vault Associate (003) Question 185
Single answer7a Describe how Vault encrypts dataA security team is reviewing a HashiCorp Vault deployment that stores secrets in an external storage backend. An auditor asks whether sensitive data could be exposed if someone gains direct access to the storage backend files or records. Which statement best describes how Vault protects stored data in this scenario?
- A
Vault stores secrets in plaintext in the storage backend, but relies on filesystem permissions and TLS to protect them.
- B
Vault encrypts data before writing it to the storage backend, using an encryption hierarchy rooted in the unseal key material.
- C
Vault sends data to the storage backend over TLS, and the storage backend is responsible for encrypting secrets at rest.
- D
Vault hashes secrets before storing them, so even Vault cannot recover the original values after they are written.
Show answer and explanation
Correct answer: B
Explanation
Vault's security model assumes the storage backend should not be trusted with plaintext secret data. Vault encrypts data before writing it to storage by using its internal encryption barrier. At a high level, Vault uses an encryption hierarchy: unseal key material is involved in recovering the master key, and the master key protects the barrier that encrypts persisted data. This is why an attacker with only backend access should not be able to read secret values. This topic is covered in HashiCorp documentation on Vault's seal/unseal process and data encryption model, including the security barrier and key hierarchy concepts. A practical takeaway for exam candidates is that backend encryption and TLS are useful defense-in-depth measures, but Vault's own encryption of data at rest is the primary control being tested here.
- A. Incorrect.
Incorrect. This reflects a common misconception that Vault depends primarily on the storage system's protections. In reality, Vault performs its own encryption of data before persisting it to storage. TLS protects data in transit, and filesystem permissions help with host security, but Vault does not store secret values in plaintext in its backend.
- B. Correct.
Correct. Vault uses a barrier-based encryption model to encrypt data before it is written to the storage backend. The root of this protection is the unseal key material, which is used to decrypt the master key that in turn protects the data encryption process. This means that direct access to the storage backend does not by itself reveal the stored secret values.
- C. Incorrect.
Incorrect. While TLS may protect communication to some backends and backend-native encryption may also exist, Vault does not rely on the storage backend alone for confidentiality. Vault's core design is that data is encrypted by Vault prior to storage, regardless of backend, which is why backends are often described as untrusted from a confidentiality standpoint.
- D. Incorrect.
Incorrect. Hashing is one-way and would prevent Vault from returning the original secret value, which would defeat the purpose of a secrets manager for most stored secrets. Vault encrypts secret data so it can later decrypt and return it to authorized clients. Hashing is used in some specific contexts, such as verification workflows, but not as the general storage mechanism for retrievable secrets.