Vault Enterprise Hsm Integration — 10 Questions

Question 1

You have enabled 'seal_wrap' in Vault Enterprise. Which specific cryptographic operation is performed by the HSM under this feature?

Accepted Answer

Encrypting the Master Key Encryption Key (KEK).. When seal_wrap is enabled in Vault Enterprise, the HSM is used to wrap (encrypt) the Master Key Encryption Key (KEK) rather than storing it in plaintext on disk. The HSM performs the cryptographic wrap/unwrap operation on the KEK, so the root of trust never leaves the HSM boundary. This is the core purpose of seal wrapping: protecting the KEK with HSM-backed cryptography.

Answer

Signing Vault audit logs.

Answer

Generating random numbers for the entropy pool.

Answer

Performing TLS termination for Vault clients.

Question 2

You are configuring Vault to use a Network HSM. The connection is intermittent. Which configuration parameter controls the timeout for HSM communication?

Accepted Answer

timeout. In Vault's PKCS#11 HSM configuration, the `timeout` parameter (specified in the HSM stanza) controls how long Vault waits for a response from the HSM before timing out. This is critical when the HSM connection is intermittent, as it prevents Vault from hanging indefinitely on unresponsive HSM calls. The parameter is set in seconds and applies to all communication with the HSM, including key generation and encryption operations.

Answer

hsm_timeout

Answer

connection_timeout

Answer

max_request_time

Question 3

You are troubleshooting a performance issue where Vault seems to be stalling during cryptographic operations. You suspect the HSM is the bottleneck. Which Vault metric should you examine to confirm HSM latency?

Accepted Answer

vault.seal.hsm.request_duration. The metric 'vault.seal.hsm.request_duration' measures the time taken for HSM operations during seal/unseal and cryptographic tasks, making it the direct indicator of HSM latency. If the HSM is the bottleneck, this metric will show elevated durations. Examining it confirms whether cryptographic operations are being delayed by the HSM.

Answer

vault.transit.request_duration

Answer

vault.hsm.session_count

Answer

vault.core.seal_setup

Question 4

When configuring an HSM for Auto-Unseal, which parameter identifies the specific hardware partition to be used?

Accepted Answer

slot. When configuring an HSM for Vault Auto-Unseal, the 'slot' parameter identifies the specific hardware partition (slot) on the HSM where the key material is stored. In PKCS#11 terminology, a slot represents a logical partition or token on the HSM, and Vault uses this parameter to select the correct slot for cryptographic operations.

Answer

token_label

Answer

partition_id

Answer

hsm_id

Question 5

You have configured a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you discover the HSM is unreachable. Vault is currently sealed. What happens when the HSM connectivity is restored?

Accepted Answer

Vault automatically detects the HSM and attempts to unseal.. When Vault is configured with an auto-unseal mechanism such as PKCS#11 HSM, the seal stanza continuously attempts to reach the HSM to retrieve the master key. If the HSM is temporarily unreachable, Vault remains sealed but keeps retrying in the background. Once connectivity is restored, Vault automatically detects the HSM and completes the unseal process without operator intervention.

Answer

Vault will transition to a 'permanently sealed' state and require a re-install.

Answer

The unseal process requires a restart of the Vault service.

Answer

Vault requires a manual 'vault operator unseal' command to trigger a retry.

Question 6

You are configuring Vault to use a PKCS#11 HSM for auto-unseal. You have verified the library path and slot ID. When starting Vault, the service fails with a 'failed to login to HSM' error despite the PIN being correct. Which configuration step is the most likely culprit?

Accepted Answer

The 'hmac_key_label' does not match a key object existing on the HSM.. The `hmac_key_label` must reference an existing HMAC key object on the HSM; if the label doesn't match a key that was generated on the HSM, Vault's PKCS#11 auto-unseal login fails with 'failed to login to HSM' even when the PIN is correct. The key label is used to locate the specific key Vault uses to encrypt/decrypt the root key, so a mismatch prevents the login/key-retrieval step from succeeding.

Answer

The HSM slot is already in use by another Vault instance.

Answer

The 'lib.so' path is pointing to a 32-bit library on a 64-bit system.

Answer

The 'pin' field is missing from the configuration file.

Question 7

When rotating the Master Key while using HSM Auto-Unseal, what happens to the existing HSM key?

Accepted Answer

The HSM key is rotated automatically in the HSM.. Rotating the Master Key creates a new key version inside the HSM or uses a new key, while the old one remains to decrypt previously encrypted data until the rotation process is complete.

Answer

Vault generates a new HSM key and destroys the configuration for the old one.

Answer

The HSM key is immediately deleted to prevent rollback.

Answer

The HSM key is unaffected; only the Vault Master Key changes.

Question 8

You are using Seal Wrap. If you perform a 'vault operator rekey', what happens to the keys protected by Seal Wrap?

Accepted Answer

The new KEK is generated and wrapped by the HSM.. Seal Wrap protects Vault's critical security parameters (including the key ring and the KEK) by wrapping them with an HSM-backed key. When 'vault operator rekey' is executed, Vault generates a new unseal key set and re-encrypts the master key, but the KEK itself is regenerated and immediately wrapped by the HSM so that the new key material remains protected under Seal Wrap. This ensures the rekey operation preserves the HSM-backed protection rather than degrading it.

Answer

Seal Wrap is disabled and must be manually re-enabled.

Answer

Seal Wrap keys are excluded from the rekey process.

Answer

The keys must be manually unwrapped and re-wrapped.

Question 9

Which THREE of the following are required configuration parameters in the 'seal' stanza when using a PKCS#11 HSM?

Accepted Answer

slot. In Vault's PKCS#11 seal configuration, the 'slot' parameter (A) is required because it identifies which HSM slot holds the token and key material the seal should use, and without it Vault cannot locate the correct cryptographic token. The 'hmac_key_label' parameter (D) is required because Vault needs the label of the HSM-resident HMAC key used to compute the integrity HMAC over the barrier keyring during unsealing. The 'lib' parameter (E) is required because it specifies the absolute path to the PKCS#11 provider shared library (e.g., /usr/lib/libpkcs11.so) that Vault loads to communicate with the HSM. 'hsm_type' (B) is not a valid PKCS#11 seal stanza parameter, and 'max_attempts' (C) is not a required PKCS#11 seal configuration field, so neither belongs in the required set.

Answer

hsm_type

Answer

max_attempts

Question 10

Which THREE of the following statements regarding PKCS#11 HSM integration in Vault are correct?

Accepted Answer

The HSM must be pre-provisioned with a key before Vault initialization.. Option A is correct because Vault's PKCS#11 auto-unseal requires the HSM to already contain a pre-provisioned key (the seal key) that Vault references during initialization; Vault does not generate or store that key itself. Option C is correct because the PKCS#11 shared library (e.g., libCryptoki2.so or vendor equivalent) must be readable and loadable by the OS user that runs the vault process, otherwise Vault cannot open the session to the token. Option E is correct because Vault runs as a non-interactive daemon and must log in to the HSM slot programmatically, so the slot/token must permit non-interactive login (typically via a stored PIN in the seal stanza) rather than requiring a human-entered password. Option B is incorrect because a Vault seal stanza supports only one HSM provider/configuration at a time, not multiple concurrent providers. Option D is incorrect because Seal Wrap is an optional Enterprise feature that adds FIPS 140-2 wrapping of barrier data; it is not a prerequisite for PKCS#11 HSM auto-unseal.

Answer

Vault supports multiple concurrent HSM providers in a single stanza.

Answer

Seal Wrap is required for all HSM integrations.