HashiCorp Vault Associate (003) Question 194
Single answer7b Explain how to seal and unseal VaultA security engineer is rotating infrastructure in a development environment and intentionally seals a Vault server before maintenance. After the server restarts, the engineer needs to return Vault to service. Auto-unseal is not configured, and the organization initialized Vault with Shamir key shares using a threshold of 3. Which action should the engineer take to make Vault operational again?
- A
Provide any 3 valid unseal key shares to the Vault server until the unseal threshold is met
- B
Log in with a root token and run an unseal command to decrypt the data
- C
Use the recovery keys to unseal the Vault server because they can replace unseal keys
- D
Restart Vault three times so it automatically reconstructs the master key from storage
Show answer and explanation
Correct answer: A
Explanation
This scenario tests practical understanding of sealing and unsealing Vault. In a manual unseal setup using Shamir keys, Vault starts in a sealed state after initialization, restart, or an explicit seal operation. To make it operational, operators must submit the required number of unseal key shares equal to the configured threshold. A root token is not involved in unsealing; it is an authorization credential used only after Vault is unsealed. Recovery keys also do not unseal a Vault server. According to Vault documentation and operational best practices, teams should securely distribute unseal key shares among trusted custodians and understand whether their deployment uses Shamir manual unseal or auto-unseal, since the operational procedures differ significantly.
- A. Correct.
Correct. When Vault is using Shamir seal and auto-unseal is not configured, the server must be manually unsealed after a restart or seal operation. With a threshold of 3, any 3 valid unseal key shares are submitted to reconstruct the key material needed to decrypt the data encryption key and transition Vault from sealed to unsealed state.
- B. Incorrect.
Incorrect. A root token is used for authorization after Vault is already unsealed and able to process authenticated requests. It does not replace unseal key shares and cannot be used to decrypt Vault during the unseal process.
- C. Incorrect.
Incorrect. Recovery keys are not the same as unseal keys. In auto-unseal configurations, recovery keys are typically used for recovery operations such as generating a new root token or certain recovery workflows, but they do not unseal the Vault server. In a Shamir manual unseal setup, the required items are unseal key shares.
- D. Incorrect.
Incorrect. Vault does not reconstruct the master key simply by restarting multiple times. A sealed Vault remains sealed until the required unseal process is completed, either manually with the threshold number of unseal key shares or automatically when auto-unseal is configured.