HashiCorp Vault Associate (003) Question 189
Single answer7a Describe how Vault encrypts dataA security engineer is reviewing a new HashiCorp Vault deployment that uses integrated storage. The engineer wants to confirm how Vault protects sensitive data after startup and unsealing. Which statement best describes how Vault encrypts data in this scenario?
- A
Vault stores all data in plaintext on disk and relies on TLS alone to protect confidentiality during access.
- B
Vault encrypts data at rest using an encryption key, and that key is itself protected by the root key kept encrypted by the unseal key material.
- C
Vault uses the unseal key directly to encrypt and decrypt every secret written to storage.
- D
Vault encrypts data only when using an external HSM; integrated storage does not provide encryption at rest.
Show answer and explanation
Correct answer: B
Explanation
Vault uses a barrier encryption model to protect persisted data. In practical terms, Vault encrypts data before writing it to storage, including integrated storage. The key hierarchy matters: the root key is central to protecting encrypted data, and the unseal key material is used to decrypt the root key or reconstruct access to it during unseal. This is why Vault can remain sealed until operators provide unseal keys or an auto-unseal mechanism is available. TLS protects data in transit, while the barrier protects data at rest. HashiCorp documentation on seals, unsealing, and the security model emphasizes that unseal keys do not directly encrypt every secret; instead, they protect access to the root key that enables Vault to decrypt its storage barrier.
- A. Incorrect.
Incorrect. TLS protects data in transit between clients and Vault, but it does not replace Vault's storage encryption. Vault encrypts sensitive data before writing it to the storage backend, including integrated storage. A common misconception is that transport security alone is enough, but Vault is specifically designed to encrypt persisted data as well.
- B. Correct.
Correct. Vault uses a key hierarchy. Data written to storage is encrypted at rest with an encryption key, while the root key protects the key material used for storage encryption. The root key is itself encrypted by the unseal key material. During unseal, Vault reconstructs the ability to decrypt the root key, which then allows access to the encrypted data. This reflects Vault's barrier encryption model.
- C. Incorrect.
Incorrect. The unseal key is not used for routine encryption and decryption of every stored secret. Its purpose is to decrypt or reconstruct access to the root key during the unseal process. Candidates often confuse the operational role of the unseal key with the storage encryption process itself.
- D. Incorrect.
Incorrect. Vault provides encryption at rest regardless of whether the storage backend is integrated storage or another supported backend. An HSM can be used to protect key material or support auto-unseal, but encryption at rest is a core Vault capability and not limited to HSM-based deployments.