HashiCorp Vault Associate (003) Question 187
Single answer7a Describe how Vault encrypts dataA security team is reviewing a new HashiCorp Vault deployment before approving it for production. They want to confirm how Vault protects sensitive data stored in its backend and what role unsealing plays. Which statement best describes how Vault encrypts data in this scenario?
- A
Vault encrypts secrets before writing them to storage by using an encryption key that is protected by the root key; unsealing reconstructs the root key so Vault can decrypt the encryption key and access data.
- B
Vault stores secrets in plaintext in the storage backend and relies on TLS alone to protect them; unsealing only enables API access for clients.
- C
Vault encrypts all stored secrets directly with the unseal keys, so each unseal key holder can independently decrypt stored data from the backend.
- D
Vault sends secrets to the storage backend encrypted by the backend's native encryption mechanism, and Vault unseal keys are only used for authenticating storage nodes.
Show answer and explanation
Correct answer: A
Explanation
Vault protects data at rest through its storage barrier, encrypting data before it is written to the storage backend. The key hierarchy is central: Vault data is encrypted with an encryption key, and that key is encrypted by the root key. In a Shamir seal configuration, the root key is split into unseal key shares; enough shares must be provided to reconstruct the root key during unseal. In auto-unseal, an external KMS, HSM, or similar mechanism helps Vault recover the root key without manual key shares. This is why unsealing is necessary after startup: Vault must regain access to the root key so it can decrypt the encryption key and read protected data from storage. This behavior is described in HashiCorp documentation on the seal/unseal process and Vault's security model, including the storage barrier and key hierarchy. A best-practice takeaway is that Vault's encryption at rest is independent of backend-native encryption and complementary to TLS, which only protects data in transit.
- A. Correct.
Correct. Vault uses a key hierarchy. Data written to storage is encrypted before being persisted, typically with the data encryption key often referred to in Vault documentation as the encryption key or barrier key. That key is itself protected by the root key. During unseal, Vault reconstructs the root key from unseal key shares or retrieves it via auto-unseal, then uses it to decrypt the encryption key so the barrier can be opened and stored data can be accessed.
- B. Incorrect.
Incorrect. TLS protects data in transit between clients and Vault, but it does not replace encryption at rest within Vault's storage barrier. Vault does not depend on plaintext storage plus TLS. Unsealing is specifically about making the encrypted data in storage accessible to Vault, not just enabling API traffic.
- C. Incorrect.
Incorrect. Unseal keys are not used to directly encrypt application secrets in storage. They are part of the process to reconstruct the root key during unseal in Shamir-based sealing, or they are replaced operationally by an external KMS/HSM in auto-unseal. A common misconception is that unseal key holders can decrypt stored backend data themselves, which is not how Vault's encryption model works.
- D. Incorrect.
Incorrect. Even if the underlying storage system offers its own encryption features, Vault still encrypts data before writing it to storage. Vault's unseal keys are not used to authenticate storage nodes. They are related to reconstructing or enabling access to the root key that decrypts the encryption key for the storage barrier.