HashiCorp Vault Associate (003) Question 190
Single answer7b Explain how to seal and unseal VaultA company runs a Vault cluster with Shamir seal enabled and a key threshold of 3. After a planned maintenance reboot, the primary node remains sealed. The on-call engineer has one unseal key and a valid Vault token with administrative privileges. They need to restore service as quickly as possible without changing the seal configuration. Which action should they take?
- A
Use the administrative token to run a command that unseals Vault, because privileged tokens can bypass the unseal threshold
- B
Provide any 3 valid unseal key shares to the node, because a Shamir-sealed Vault requires the threshold number of key shares to unseal after a restart
- C
Log in to the Vault UI and generate a new root token, which automatically unseals the node as part of recovery
- D
Re-run vault operator init on the node to create a new set of unseal keys and bring the existing Vault data back online
Show answer and explanation
Correct answer: B
Explanation
The correct response is to provide 3 valid unseal key shares. In a Vault deployment using Shamir seal, Vault starts in a sealed state after startup or restart and must be unsealed by reconstructing the key material through the configured threshold of unseal shares. Administrative tokens, including root-equivalent privileges, do not replace the unseal process because authentication happens only after the barrier is opened. Re-initializing Vault is a common but serious misconception: initialization is a one-time action for a new Vault cluster, not a recovery step for a sealed but already initialized cluster. HashiCorp Vault documentation on sealing and unsealing explains that Shamir-sealed Vault requires submitting the threshold number of key shares, while auto-unseal changes this behavior by delegating key access to an external KMS/HSM.
- A. Incorrect.
Incorrect. Vault tokens are used for authenticated API operations after Vault is unsealed. They do not bypass the seal mechanism. When Vault is sealed, the barrier protecting the encryption key is locked, and normal token-based operations are not sufficient to unseal it.
- B. Correct.
Correct. With Shamir seal, Vault must be unsealed by submitting the configured threshold number of unseal key shares. In this scenario, the threshold is 3, so the engineer must gather and enter any 3 valid shares. This is the standard operational process after a restart unless auto-unseal is configured.
- C. Incorrect.
Incorrect. A root token does not unseal Vault. Root token generation is a separate privileged workflow and requires Vault to be operational enough to perform that process. Unsealing is specifically about reconstructing access to the master key using the required unseal key shares.
- D. Incorrect.
Incorrect. The init operation is only for a brand-new, uninitialized Vault. Running vault operator init on an already initialized Vault is not the correct recovery action and would not be used to recover access to existing encrypted data after a normal restart.