HashiCorp Vault Associate (003) Question 218
Single answer8c Explain the uses of Shamir secret sharing and unsealingA company runs Vault in production using the integrated storage backend. After a full cluster restart during a maintenance window, the operations team finds that Vault is sealed and unavailable. The security lead says no single administrator should be able to bring Vault back online alone, and the recovery process must require participation from multiple trusted people. Which approach best meets this requirement when using Shamir seals?
- A
Initialize Vault with Shamir key shares and configure an unseal threshold so that several custodians must provide their unseal keys to unseal the Vault
- B
Store the root token in a secure password manager and use it after restart to unseal Vault because root tokens can decrypt the barrier
- C
Enable auto-unseal with a cloud KMS and distribute the KMS IAM credentials to several administrators so they can jointly unseal Vault
- D
Use recovery keys instead of unseal keys because recovery keys are submitted during normal Shamir unseal operations
Show answer and explanation
Correct answer: A
Explanation
The best answer is to use Shamir secret sharing with a threshold greater than one. In Vault, when using a Shamir seal, the unseal key is split into multiple shares, and a minimum number of those shares must be provided to unseal the Vault after startup or a seal event. This is specifically designed to support split knowledge and separation of duties. Root tokens do not participate in unsealing. Recovery keys are not substitutes for Shamir unseal keys in standard Shamir unseal workflows. If an organization wants no manual unseal ceremony, it would use auto-unseal with a supported KMS or HSM, but that changes the operating model and does not satisfy the requirement for multiple trusted people to take part in unsealing. This aligns with HashiCorp Vault documentation on initialization, Shamir secret sharing, sealing, and unsealing behavior.
- A. Correct.
Correct. With a Shamir seal, Vault splits the master key into multiple unseal key shares using Shamir's Secret Sharing. You define the number of shares and the threshold required to reconstruct the key material needed for unsealing. This directly supports separation of duties because no single custodian can unseal Vault alone if the threshold is greater than one.
- B. Incorrect.
Incorrect. A root token is used for administrative API access after Vault is unsealed; it does not unseal Vault. Unsealing is a cryptographic process that requires unseal key shares when using Shamir. Confusing root tokens with unseal keys is a common misconception.
- C. Incorrect.
Incorrect. Auto-unseal can reduce or eliminate manual unseal steps by having Vault use an external KMS/HSM to access the key-encryption key, but that does not implement the stated requirement for multiple humans to participate in each unseal event. Distributing IAM credentials is also not how Shamir secret sharing works and would weaken control objectives rather than enforce threshold-based participation.
- D. Incorrect.
Incorrect. Recovery keys are not used for normal unseal operations with Shamir. Recovery keys are associated with auto-unseal configurations for certain recovery workflows, while Shamir unseal requires unseal key shares. Choosing this option reflects a misunderstanding of the difference between unseal keys and recovery keys.