HashiCorp Vault Associate (003) Question 215
Single answer8c Explain the uses of Shamir secret sharing and unsealingA company runs Vault with Shamir seal in production. During a planned restart after maintenance, the Vault server comes back up in a sealed state. The security team wants to prevent any one administrator from being able to unseal Vault alone, but they also want to be able to recover service without involving every key holder. Vault was initialized with 5 unseal key shares and a key threshold of 3. Which statement best describes how Vault should be unsealed in this situation?
- A
Any 3 of the 5 unseal key shares can be provided to reconstruct the unseal key and unseal Vault; no single share is sufficient by itself.
- B
All 5 unseal key shares must be entered after every restart because the master key is split evenly across all holders.
- C
A root token can be used instead of unseal keys if the operator has administrative privileges.
- D
Any one administrator with access to the storage backend can bypass Shamir unsealing and start Vault in an unsealed state.
Show answer and explanation
Correct answer: A
Explanation
This scenario tests the practical use of Shamir secret sharing in Vault's seal and unseal workflow. In a Shamir seal configuration, Vault generates an unseal key and splits it into a configured number of shares. A minimum threshold of those shares is required to reconstruct the key and unseal Vault. This design is used to enforce separation of duties and reduce the risk of a single person being able to unseal the cluster alone. In the example given, 5 shares were created and 3 are required, so any 3 valid shares can unseal Vault after a restart. This is a common production pattern because it balances security and operational recovery. By contrast, a root token is not involved in unsealing, and storage access alone cannot bypass the seal barrier. These behaviors align with Vault documentation on initialization, Shamir secret sharing, and the seal/unseal process.
- A. Correct.
Correct. With Shamir secret sharing, Vault splits the unseal key into shares and requires only the configured threshold number of shares to reconstruct it. In a 5-share, threshold-3 configuration, any 3 valid shares can be used to unseal Vault. This supports separation of duties because no individual share can unseal Vault alone, while also avoiding the operational burden of requiring all 5 holders.
- B. Incorrect.
Incorrect. This confuses the total number of shares with the threshold. Vault does not require every unseal key share unless the threshold was configured to equal the total number of shares. Here, the threshold is 3, so entering all 5 is unnecessary. A common misconception is that all shares are always needed because the key was split among 5 people.
- C. Incorrect.
Incorrect. A root token does not replace the unseal process. Tokens, including root tokens, are used only after Vault is unsealed and able to service authenticated requests. When Vault is sealed, it cannot use its encryption key material to access stored data, so token-based administration cannot bypass unsealing.
- D. Incorrect.
Incorrect. Access to the storage backend does not bypass the seal mechanism. Vault keeps critical key material protected such that data in storage remains inaccessible while sealed. Shamir unsealing is specifically intended to require the threshold number of unseal key shares before Vault can decrypt its barrier key material and become operational.