HashiCorp Vault Associate (003) Question 186
Single answer7a Describe how Vault encrypts dataA security team is reviewing a new HashiCorp Vault deployment used to store database passwords and API keys. An auditor asks how Vault protects this sensitive data if someone gains access to the backend storage, such as the integrated storage files or an external storage system. Which statement best describes how Vault encrypts data in this scenario?
- A
Vault stores secrets in plaintext in the storage backend and relies on TLS to protect them during access.
- B
Vault encrypts data before writing it to storage, using an encryption hierarchy rooted in the master key; the storage backend does not need to understand the secret contents.
- C
Vault sends all secrets to an external KMS for encryption and never performs encryption itself unless Transit is enabled.
- D
Vault only encrypts dynamic secrets, while static secrets are protected by access policies rather than encryption.
Show answer and explanation
Correct answer: B
Explanation
Vault protects stored data through barrier encryption. Before data is written to the storage backend, Vault encrypts it so the backend only holds ciphertext, not readable secrets. The encryption process uses an internal key hierarchy associated with the seal and master key mechanisms. This is why backend storage can be treated as untrusted from a confidentiality perspective. TLS is still important, but it protects data in transit, not data at rest. External KMS or HSM integrations are commonly used for auto-unseal or seal support, not because Vault offloads all routine secret encryption to them. For Vault Associate-level understanding, the key takeaway is: Vault encrypts secrets before storing them, and the storage backend does not need native knowledge of or access to plaintext secret values. This aligns with HashiCorp Vault documentation on the security model, barrier encryption, and sealing/unsealing behavior.
- A. Incorrect.
Incorrect. TLS protects data in transit between clients and Vault, but it does not mean data is safe at rest in the storage backend. Vault does not store secrets in plaintext in backend storage. A common misconception is to equate transport encryption with storage encryption.
- B. Correct.
Correct. Vault encrypts data before it is persisted to the storage backend. It uses an internal encryption hierarchy: data is encrypted with an encryption key, and that process is ultimately rooted in the master key used to protect the keyring. This design means that even if an attacker can read raw storage entries, they cannot directly read the plaintext secrets without the necessary keys. This is the key concept auditors typically expect when discussing Vault's at-rest encryption model.
- C. Incorrect.
Incorrect. Vault can integrate with external KMS or HSM systems for auto-unseal or seal operations, but it does not require sending all secrets to an external KMS for encryption. Vault performs its own barrier encryption of data at rest. Transit is a separate secrets engine for encryption-as-a-service and is not required for Vault to encrypt its own stored data.
- D. Incorrect.
Incorrect. Vault encrypts data it stores regardless of whether the secret is static or dynamic. Access policies control who can read or manage secrets, but authorization is separate from encryption at rest. This option reflects the mistaken idea that policy enforcement replaces cryptographic protection.