Vault Enterprise Hsm Integration — 20 Questions

Question 1

When rotating the Master Key while using HSM Auto-Unseal, what happens to the existing HSM key?

Accepted Answer

The HSM key is rotated automatically in the HSM.. Rotating the Master Key creates a new key version inside the HSM or uses a new key, while the old one remains to decrypt previously encrypted data until the rotation process is complete.

Answer

Vault generates a new HSM key and destroys the configuration for the old one.

Answer

The HSM key is immediately deleted to prevent rollback.

Answer

The HSM key is unaffected; only the Vault Master Key changes.

Question 2

If you need to rotate the key on the HSM used for Seal Wrap, what is the recommended procedure?

Accepted Answer

Use the 'vault operator seal-wrap rekey' command.. The 'vault operator seal-wrap rekey' command (or equivalent rotation process) allows Vault to transition to a new key on the HSM while maintaining access to existing data.

Answer

There is no way to rotate the key; the HSM must be re-initialized.

Answer

Restart Vault with a new 'hmac_key_label'.

Answer

Delete the old key in the HSM and create a new one.

Question 3

What happens to the Vault audit logs if the HSM becomes unavailable?

Accepted Answer

Vault continues to write audit logs normally.. Vault audit logs are independent of the HSM unseal mechanism. Vault will continue to write logs, provided the storage for audit logs is available.

Answer

Vault encrypts the audit logs with a fallback key.

Answer

Audit logs are buffered in memory until the HSM is back.

Answer

Vault stops writing audit logs immediately.

Question 4

You have enabled 'seal_wrap' in Vault Enterprise. Which specific cryptographic operation is performed by the HSM under this feature?

Accepted Answer

Encrypting the Master Key Encryption Key (KEK).. Seal Wrap uses the HSM to encrypt the Master Key or specific data keys, ensuring the encryption keys never leave the HSM boundary in plaintext.

Answer

Signing Vault audit logs.

Answer

Generating random numbers for the entropy pool.

Answer

Performing TLS termination for Vault clients.

Question 5

You are configuring Vault to use a Network HSM. The connection is intermittent. Which configuration parameter controls the timeout for HSM communication?

Accepted Answer

timeout. The 'timeout' parameter within the seal configuration defines the maximum duration Vault waits for a response from the HSM provider.

Answer

hsm_timeout

Answer

connection_timeout

Answer

max_request_time

Question 6

You are troubleshooting a performance issue where Vault seems to be stalling during cryptographic operations. You suspect the HSM is the bottleneck. Which Vault metric should you examine to confirm HSM latency?

Accepted Answer

vault.seal.hsm.request_duration. The 'vault.seal.hsm.request_duration' metric (or similar telemetry depending on the version) tracks the latency of requests made to the HSM provider.

Answer

vault.transit.request_duration

Answer

vault.hsm.session_count

Answer

vault.core.seal_setup

Question 7

Which of the following is a requirement for the PKCS#11 library used with Vault Auto-Unseal?

Accepted Answer

The library must be PKCS#11 compliant.. Vault requires the HSM vendor's shared object library (.so or .dll) to support the PKCS#11 interface standard.

Answer

The library must be statically linked into the Vault binary.

Answer

The library must be written in Go.

Answer

The library must support the KMIP protocol.

Question 8

When configuring an HSM for Auto-Unseal, which parameter identifies the specific hardware partition to be used?

Accepted Answer

slot. The 'slot' parameter in the seal stanza defines which slot within the PKCS#11 library Vault should target.

Answer

token_label

Answer

partition_id

Answer

hsm_id

Question 9

You have configured a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you discover the HSM is unreachable. Vault is currently sealed. What happens when the HSM connectivity is restored?

Accepted Answer

Vault automatically detects the HSM and attempts to unseal.. Vault periodically retries the seal initialization process. Once the HSM becomes reachable, Vault attempts to use the provided credentials to unseal itself automatically.

Answer

Vault will transition to a 'permanently sealed' state and require a re-install.

Answer

The unseal process requires a restart of the Vault service.

Answer

Vault requires a manual 'vault operator unseal' command to trigger a retry.

Question 10

You are implementing Seal Wrap to protect transit engine keys using an HSM. You have enabled the 'seal_wrap' configuration. After restarting, how does Vault handle existing data keys in the transit engine?

Accepted Answer

Only keys created or rotated after the configuration change will be wrapped by the HSM.. Seal Wrap with an HSM does not retroactively wrap existing data keys; it applies to new keys or keys that are rotated after the configuration is applied.

Answer

The transit engine is disabled until the 're-wrap' command is issued.

Answer

Vault automatically re-wraps all existing keys upon service startup.

Answer

Vault will return an error until all transit keys are manually deleted.

Question 11

You are configuring Vault to use a PKCS#11 HSM for auto-unseal. You have verified the library path and slot ID. When starting Vault, the service fails with a 'failed to login to HSM' error despite the PIN being correct. Which configuration step is the most likely culprit?

Accepted Answer

The 'hmac_key_label' does not match a key object existing on the HSM.. The 'hmac_key_label' or 'key_label' in the seal configuration must match the label of the key pre-provisioned on the HSM. If the label is incorrect or missing, the PKCS#11 module will fail to authenticate the key object.

Answer

The HSM slot is already in use by another Vault instance.

Answer

The 'lib.so' path is pointing to a 32-bit library on a 64-bit system.

Answer

The 'pin' field is missing from the configuration file.

Question 12

What is the primary benefit of using HSM Auto-Unseal for a Vault cluster?

Accepted Answer

It allows Vault to unseal without manual intervention.. Auto-Unseal removes the need for manual distribution of unseal keys, reducing operational overhead and the risk of human error during the unseal process.

Answer

It provides backup redundancy for the Vault data.

Answer

It replaces the need for TLS encryption.

Answer

It increases the throughput of the storage backend.

Question 13

When configuring the PKCS#11 library, how does Vault find the library on the host OS?

Accepted Answer

The path is provided in the 'lib' field of the seal configuration.. The 'lib' parameter in the seal stanza must contain the absolute file system path to the PKCS#11 shared library provided by the HSM vendor.

Answer

The path is defined in the Vault environment variables.

Answer

Vault expects the library to be located in '/usr/lib/vault'.

Answer

Vault looks in the LD_LIBRARY_PATH environment variable by default.

Question 14

During an HSM failover event, your Vault nodes lose access to the primary HSM. You have configured a secondary HSM. How does Vault handle this?

Accepted Answer

Vault requires a manual update to the seal configuration and a restart.. Vault is configured for a single HSM provider at a time; failover to a different HSM would typically require updating the seal configuration and restarting, or using a load balancer in front of a clustered HSM.

Answer

Vault waits until the primary HSM is back online.

Answer

Vault automatically detects the secondary HSM and switches over.

Answer

Vault fails over to Shamir's Secret Sharing mode.

Question 15

What permission level is required for the user account used to authenticate with the HSM?

Accepted Answer

The account must have Crypto User (CU) privileges.. The HSM user account must have permissions to create, read, and use cryptographic keys. Usually, a 'Crypto User' (CU) role is sufficient.

Answer

The account must be the partition owner.

Answer

The account must have anonymous access.

Answer

The account must have full Administrative (SO) privileges.

Question 16

Which Vault command is used to check the status of the seal configuration and verify if it is using an HSM?

Accepted Answer

vault status. The 'vault status' command displays the seal type (e.g., 'shamir' or 'pkcs11') and the current seal status.

Answer

vault operator hsm-check

Answer

vault read sys/seal-config

Answer

vault seal-status

Question 17

You are using Seal Wrap. If you perform a 'vault operator rekey', what happens to the keys protected by Seal Wrap?

Accepted Answer

The new KEK is generated and wrapped by the HSM.. When rekeying, Vault re-encrypts the Master Key/KEK. If Seal Wrap is enabled, the HSM is used to perform the cryptographic operations for the new key, ensuring the chain of protection remains intact.

Answer

Seal Wrap is disabled and must be manually re-enabled.

Answer

Seal Wrap keys are excluded from the rekey process.

Answer

The keys must be manually unwrapped and re-wrapped.

Question 18

Which THREE of the following are required configuration parameters in the 'seal' stanza when using a PKCS#11 HSM?

Accepted Answer

slot. The 'seal' configuration for PKCS#11 requires the library path, the slot identifier, and the key label to locate the cryptographic material.

Answer

hsm_type

Answer

max_attempts

Question 19

Which THREE of the following statements regarding PKCS#11 HSM integration in Vault are correct?

Accepted Answer

The HSM must be pre-provisioned with a key before Vault initialization.. Vault requires specific library versions, a pre-provisioned key, and proper configuration in the seal stanza for successful PKCS#11 integration.

Answer

Vault supports multiple concurrent HSM providers in a single stanza.

Answer

Seal Wrap is required for all HSM integrations.

Question 20

Which TWO of the following are benefits of using Seal Wrap in Vault Enterprise?

Accepted Answer

Compliance with FIPS 140-2/3 requirements.. Seal Wrap adds an extra layer of security by ensuring keys never exist in plaintext memory and allows for easier compliance with regulations requiring HSM-backed key protection.

Answer

Automatic failover to a standby Vault cluster.

Answer

Increased storage backend performance.

Answer

Automatic deletion of audit logs.