HashiCorp Vault Associate (003) Question 192
Single answer7b Explain how to seal and unseal VaultA company runs a Vault cluster with Shamir seal enabled and a key threshold of 3 out of 5. After a maintenance window, one Vault server is restarted and shows as sealed. The operations engineer must restore access to that server without changing the cluster's seal configuration. Which action should the engineer take?
- A
Authenticate to Vault with a root token and run a command to decrypt the storage backend
- B
Provide any 3 of the 5 unseal keys to that server until it reports unsealed
- C
Re-run
vault operator initon the restarted server to generate a new set of unseal keys - D
Use the recovery keys to unseal the server because recovery keys replace unseal keys in all seal types
Show answer and explanation
Correct answer: B
Explanation
This question tests practical understanding of how to unseal Vault after a node restart when using Shamir seal. In a Shamir-sealed Vault, the unseal process requires the configured threshold of unseal key shares to reconstruct the portion of key material needed to decrypt the master key and make the node operational. A restart does not mean Vault must be reinitialized, and administrative tokens do not bypass the seal process. Candidates should also distinguish unseal keys from recovery keys: unseal keys are used with Shamir seal, while recovery keys are used in auto-unseal deployments for recovery-related operations rather than routine unsealing. This aligns with HashiCorp Vault documentation on sealing/unsealing, vault operator init, and the differences between Shamir seal and auto-unseal behavior.
- A. Incorrect.
Incorrect. A root token is not used to unseal Vault. Sealing and unsealing control access to Vault's master key used to decrypt data encryption keys, and this process is separate from normal authentication and authorization. Even highly privileged tokens, including root tokens, do not replace unseal keys for a Shamir-sealed Vault.
- B. Correct.
Correct. With Shamir seal, Vault must be unsealed by supplying the required threshold number of unseal key shares. In this scenario, the threshold is 3 of 5, so the engineer should enter any 3 valid unseal keys on the restarted server. This restores that node to an unsealed state without reinitializing or changing cluster configuration.
- C. Incorrect.
Incorrect.
vault operator initis used only once when creating a new Vault cluster or initializing an uninitialized Vault. Running initialization again on an existing cluster node is not the correct action and would indicate a misunderstanding of node restart versus cluster initialization. Restarting a sealed node does not require generating new unseal keys. - D. Incorrect.
Incorrect. Recovery keys are not universally used to unseal Vault. In a Shamir-sealed Vault, unseal keys are used for the unseal process. Recovery keys are associated with auto-unseal scenarios and certain recovery operations, not standard Shamir unseal. This option reflects a common confusion between unseal keys and recovery keys.