HashiCorp Vault Associate (003) Question 188
Single answer7a Describe how Vault encrypts dataA security engineer is reviewing a new HashiCorp Vault deployment used to store database credentials and API keys. During an audit, the engineer is asked to explain how Vault protects secret data if someone gains direct access to the storage backend. Which statement best describes how Vault encrypts data in this situation?
- A
Vault encrypts secret data before writing it to storage, using an encryption key protected by the key hierarchy rooted in the unseal key.
- B
Vault relies on the storage backend to encrypt secret data, and the unseal key is only used for TLS certificates.
- C
Vault stores secrets in plaintext in the storage backend, but protects them by requiring authenticated API access.
- D
Vault encrypts all data only in transit; data at rest is protected solely by filesystem permissions on the Vault server.
Show answer and explanation
Correct answer: A
Explanation
Vault uses barrier encryption to protect data at rest. Before writing secrets or other sensitive data to the storage backend, Vault encrypts that data. In Vault's key hierarchy, the unseal key is used to decrypt the root key during unseal operations, and the root key protects the key material used to encrypt and decrypt stored data. This design means that even if someone obtains raw access to the storage backend, they cannot read secret values without the necessary key material. This is a foundational concept for the Vault Associate exam and is documented in HashiCorp Vault documentation covering the seal/unseal process, the security barrier, and encryption at rest. Backend encryption, TLS, and operating system permissions can add security, but they do not replace Vault's own encryption of stored data.
- A. Correct.
Correct. Vault encrypts data before it is persisted to its storage backend, so the backend does not need to understand or manage the secret contents. Vault uses a key hierarchy: the unseal key is used to decrypt the root key, and the root key protects the encryption key used for the data. This is the core of Vault's barrier encryption model and is exactly what protects stored secrets if someone accesses the backend directly.
- B. Incorrect.
Incorrect. This reflects a common misconception that Vault delegates encryption of secret values to the storage backend. While backend-level encryption may still be used as an additional control, Vault itself performs encryption before writing data. The unseal key is not related to TLS certificates; it is part of the mechanism used to decrypt the root key during the unseal process.
- C. Incorrect.
Incorrect. Vault does not store secrets in plaintext in the storage backend. Authentication and authorization protect API access, but they are not the mechanism for at-rest protection. If an attacker can read the backend directly, barrier encryption is what prevents disclosure of the secret values.
- D. Incorrect.
Incorrect. Vault does encrypt data in transit with TLS, but it also encrypts data at rest before storage. Filesystem permissions and host controls are useful defense-in-depth measures, but they are not Vault's primary mechanism for protecting stored secret data.