Vault Enterprise Hsm Integration — 15 Questions

Question 1

You have enabled 'seal_wrap' in Vault Enterprise. Which specific cryptographic operation is performed by the HSM under this feature?

Accepted Answer

Encrypting the Master Key Encryption Key (KEK).. When seal_wrap is enabled in Vault Enterprise, the HSM is used to wrap (encrypt) the Master Key Encryption Key (KEK) rather than storing it in plaintext on disk. The HSM performs the cryptographic wrap/unwrap operation on the KEK, so the root of trust never leaves the HSM boundary. This is the core purpose of seal wrapping: protecting the KEK with HSM-backed cryptography.

Answer

Signing Vault audit logs.

Answer

Generating random numbers for the entropy pool.

Answer

Performing TLS termination for Vault clients.

Question 2

You are configuring Vault to use a Network HSM. The connection is intermittent. Which configuration parameter controls the timeout for HSM communication?

Accepted Answer

timeout. In Vault's PKCS#11 HSM configuration, the `timeout` parameter (specified in the HSM stanza) controls how long Vault waits for a response from the HSM before timing out. This is critical when the HSM connection is intermittent, as it prevents Vault from hanging indefinitely on unresponsive HSM calls. The parameter is set in seconds and applies to all communication with the HSM, including key generation and encryption operations.

Answer

hsm_timeout

Answer

connection_timeout

Answer

max_request_time

Question 3

You are troubleshooting a performance issue where Vault seems to be stalling during cryptographic operations. You suspect the HSM is the bottleneck. Which Vault metric should you examine to confirm HSM latency?

Accepted Answer

vault.seal.hsm.request_duration. The metric 'vault.seal.hsm.request_duration' measures the time taken for HSM operations during seal/unseal and cryptographic tasks, making it the direct indicator of HSM latency. If the HSM is the bottleneck, this metric will show elevated durations. Examining it confirms whether cryptographic operations are being delayed by the HSM.

Answer

vault.transit.request_duration

Answer

vault.hsm.session_count

Answer

vault.core.seal_setup

Question 4

When configuring an HSM for Auto-Unseal, which parameter identifies the specific hardware partition to be used?

Accepted Answer

slot. When configuring an HSM for Vault Auto-Unseal, the 'slot' parameter identifies the specific hardware partition (slot) on the HSM where the key material is stored. In PKCS#11 terminology, a slot represents a logical partition or token on the HSM, and Vault uses this parameter to select the correct slot for cryptographic operations.

Answer

token_label

Answer

partition_id

Answer

hsm_id

Question 5

You have configured a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you discover the HSM is unreachable. Vault is currently sealed. What happens when the HSM connectivity is restored?

Accepted Answer

Vault automatically detects the HSM and attempts to unseal.. When Vault is configured with an auto-unseal mechanism such as PKCS#11 HSM, the seal stanza continuously attempts to reach the HSM to retrieve the master key. If the HSM is temporarily unreachable, Vault remains sealed but keeps retrying in the background. Once connectivity is restored, Vault automatically detects the HSM and completes the unseal process without operator intervention.

Answer

Vault will transition to a 'permanently sealed' state and require a re-install.

Answer

The unseal process requires a restart of the Vault service.

Answer

Vault requires a manual 'vault operator unseal' command to trigger a retry.

Question 6

You are configuring Vault to use a PKCS#11 HSM for auto-unseal. You have verified the library path and slot ID. When starting Vault, the service fails with a 'failed to login to HSM' error despite the PIN being correct. Which configuration step is the most likely culprit?

Accepted Answer

The 'hmac_key_label' does not match a key object existing on the HSM.. The `hmac_key_label` must reference an existing HMAC key object on the HSM; if the label doesn't match a key that was generated on the HSM, Vault's PKCS#11 auto-unseal login fails with 'failed to login to HSM' even when the PIN is correct. The key label is used to locate the specific key Vault uses to encrypt/decrypt the root key, so a mismatch prevents the login/key-retrieval step from succeeding.

Answer

The HSM slot is already in use by another Vault instance.

Answer

The 'lib.so' path is pointing to a 32-bit library on a 64-bit system.

Answer

The 'pin' field is missing from the configuration file.

Question 7

When rotating the Master Key while using HSM Auto-Unseal, what happens to the existing HSM key?

Accepted Answer

The HSM key is rotated automatically in the HSM.. Rotating the Master Key creates a new key version inside the HSM or uses a new key, while the old one remains to decrypt previously encrypted data until the rotation process is complete.

Answer

Vault generates a new HSM key and destroys the configuration for the old one.

Answer

The HSM key is immediately deleted to prevent rollback.

Answer

The HSM key is unaffected; only the Vault Master Key changes.

Question 8

You are using Seal Wrap. If you perform a 'vault operator rekey', what happens to the keys protected by Seal Wrap?

Accepted Answer

The new KEK is generated and wrapped by the HSM.. Seal Wrap protects Vault's critical security parameters (including the key ring and the KEK) by wrapping them with an HSM-backed key. When 'vault operator rekey' is executed, Vault generates a new unseal key set and re-encrypts the master key, but the KEK itself is regenerated and immediately wrapped by the HSM so that the new key material remains protected under Seal Wrap. This ensures the rekey operation preserves the HSM-backed protection rather than degrading it.

Answer

Seal Wrap is disabled and must be manually re-enabled.

Answer

Seal Wrap keys are excluded from the rekey process.

Answer

The keys must be manually unwrapped and re-wrapped.

Question 9

Which THREE of the following are required configuration parameters in the 'seal' stanza when using a PKCS#11 HSM?

Accepted Answer

slot. In Vault's PKCS#11 seal configuration, the 'slot' parameter (A) is required because it identifies which HSM slot holds the token and key material the seal should use, and without it Vault cannot locate the correct cryptographic token. The 'hmac_key_label' parameter (D) is required because Vault needs the label of the HSM-resident HMAC key used to compute the integrity HMAC over the barrier keyring during unsealing. The 'lib' parameter (E) is required because it specifies the absolute path to the PKCS#11 provider shared library (e.g., /usr/lib/libpkcs11.so) that Vault loads to communicate with the HSM. 'hsm_type' (B) is not a valid PKCS#11 seal stanza parameter, and 'max_attempts' (C) is not a required PKCS#11 seal configuration field, so neither belongs in the required set.

Answer

hsm_type

Answer

max_attempts

Question 10

Which THREE of the following statements regarding PKCS#11 HSM integration in Vault are correct?

Accepted Answer

The HSM must be pre-provisioned with a key before Vault initialization.. Option A is correct because Vault's PKCS#11 auto-unseal requires the HSM to already contain a pre-provisioned key (the seal key) that Vault references during initialization; Vault does not generate or store that key itself. Option C is correct because the PKCS#11 shared library (e.g., libCryptoki2.so or vendor equivalent) must be readable and loadable by the OS user that runs the vault process, otherwise Vault cannot open the session to the token. Option E is correct because Vault runs as a non-interactive daemon and must log in to the HSM slot programmatically, so the slot/token must permit non-interactive login (typically via a stored PIN in the seal stanza) rather than requiring a human-entered password. Option B is incorrect because a Vault seal stanza supports only one HSM provider/configuration at a time, not multiple concurrent providers. Option D is incorrect because Seal Wrap is an optional Enterprise feature that adds FIPS 140-2 wrapping of barrier data; it is not a prerequisite for PKCS#11 HSM auto-unseal.

Answer

Vault supports multiple concurrent HSM providers in a single stanza.

Answer

Seal Wrap is required for all HSM integrations.

Question 11

Which TWO of the following are benefits of using Seal Wrap in Vault Enterprise?

Accepted Answer

Compliance with FIPS 140-2/3 requirements.. Option A is correct because Seal Wrap in Vault Enterprise leverages HSM-backed AES-256-GCM encryption (via PKCS#11) to wrap the barrier key and other sensitive values, which helps organizations meet FIPS 140-2/3 compliance requirements for cryptographic modules. Option C is correct because with Seal Wrap the encryption keys are wrapped by the HSM and the unwrapped key material is never exposed in plaintext outside the HSM, protecting keys even from Vault itself. The other options do not belong: automatic failover to a standby cluster is a feature of Vault Enterprise replication/HA, not Seal Wrap; increased storage backend performance is unrelated since Seal Wrap adds cryptographic overhead rather than improving throughput; and automatic deletion of audit logs is not a Seal Wrap capability, as audit log retention is controlled by audit device configuration and external log management.

Answer

Automatic failover to a standby Vault cluster.

Answer

Increased storage backend performance.

Answer

Automatic deletion of audit logs.

Question 12

If you need to rotate the key on the HSM used for Seal Wrap, what is the recommended procedure?

Accepted Answer

Use the 'vault operator seal-wrap rekey' command.. The 'vault operator seal-wrap rekey' command (or equivalent rotation process) allows Vault to transition to a new key on the HSM while maintaining access to existing data.

Answer

There is no way to rotate the key; the HSM must be re-initialized.

Answer

Restart Vault with a new 'hmac_key_label'.

Answer

Delete the old key in the HSM and create a new one.

Question 13

Which TWO of the following must be true for Seal Wrap to function correctly?

Accepted Answer

The 'seal_wrap' parameter must be set to 'true' in the configuration.. Seal Wrap requires the seal_wrap parameter to be explicitly set to true in the seal stanza of the Vault configuration, so option A is correct because without this setting Vault will not wrap the relevant key material with the HSM-backed seal. Option B is also correct because Seal Wrap depends on the cluster being initialized with an HSM seal (for example, a PKCS#11 seal), which provides the mechanism that actually performs the wrapping and unwrapping of keys. Option C is incorrect because Seal Wrap does not mandate RSA for all keys; supported HSM seal mechanisms can use other algorithms such as AES, and the requirement is about the seal mechanism, not a specific key algorithm. Option D is incorrect because Seal Wrap is independent of which secrets engines are enabled, so the transit engine need not be the only engine. Option E is incorrect because audit logs are written to configured audit devices and are not sent to the HSM as part of Seal Wrap.

Answer

The HSM must use the RSA algorithm for all keys.

Answer

The transit engine must be the only engine enabled.

Answer

All audit logs must be sent to the HSM.

Question 14

What happens to the Vault audit logs if the HSM becomes unavailable?

Accepted Answer

Vault continues to write audit logs normally.. Vault audit logs are independent of the HSM unseal mechanism. Vault will continue to write logs, provided the storage for audit logs is available.

Answer

Vault encrypts the audit logs with a fallback key.

Answer

Audit logs are buffered in memory until the HSM is back.

Answer

Vault stops writing audit logs immediately.

Question 15

A Vault Enterprise operator is preparing a new cluster for PKCS#11 auto-unseal using a SoftHSM token. After configuring the seal stanza, the operator runs `vault operator init` and receives an error that the HSM key is not found. The operator confirms the token PIN and key label are correct in `vault.hcl`. Which Vault CLI command should the operator run to create the missing encryption key in the HSM before retrying initialization?

Accepted Answer

vault write sys/managed-keys/pkcs11/<key_name> .... When using PKCS#11 auto-unseal, the HSM key must exist before Vault can use it. Vault Enterprise's managed keys feature allows operators to create keys directly in the HSM via the sys/managed-keys/pkcs11 endpoint. This avoids manual HSM key generation and ensures the key label matches the seal stanza configuration. The other commands do not provision HSM keys and would not resolve the missing key error.

Answer

vault operator init -recovery-shares=5 -recovery-threshold=3

Answer

vault write sys/sealwrap/rewrap

Answer

vault operator generate-root -init