Vault Enterprise Hsm Integration — Timed 25 Questions

Question 1

You have enabled 'seal_wrap' in Vault Enterprise. Which specific cryptographic operation is performed by the HSM under this feature?

Accepted Answer

Encrypting the Master Key Encryption Key (KEK).. When seal_wrap is enabled in Vault Enterprise, the HSM is used to wrap (encrypt) the Master Key Encryption Key (KEK) rather than storing it in plaintext on disk. The HSM performs the cryptographic wrap/unwrap operation on the KEK, so the root of trust never leaves the HSM boundary. This is the core purpose of seal wrapping: protecting the KEK with HSM-backed cryptography.

Answer

Signing Vault audit logs.

Answer

Generating random numbers for the entropy pool.

Answer

Performing TLS termination for Vault clients.

Question 2

You are configuring Vault to use a Network HSM. The connection is intermittent. Which configuration parameter controls the timeout for HSM communication?

Accepted Answer

timeout. In Vault's PKCS#11 HSM configuration, the `timeout` parameter (specified in the HSM stanza) controls how long Vault waits for a response from the HSM before timing out. This is critical when the HSM connection is intermittent, as it prevents Vault from hanging indefinitely on unresponsive HSM calls. The parameter is set in seconds and applies to all communication with the HSM, including key generation and encryption operations.

Answer

hsm_timeout

Answer

connection_timeout

Answer

max_request_time

Question 3

You are troubleshooting a performance issue where Vault seems to be stalling during cryptographic operations. You suspect the HSM is the bottleneck. Which Vault metric should you examine to confirm HSM latency?

Accepted Answer

vault.seal.hsm.request_duration. The metric 'vault.seal.hsm.request_duration' measures the time taken for HSM operations during seal/unseal and cryptographic tasks, making it the direct indicator of HSM latency. If the HSM is the bottleneck, this metric will show elevated durations. Examining it confirms whether cryptographic operations are being delayed by the HSM.

Answer

vault.transit.request_duration

Answer

vault.hsm.session_count

Answer

vault.core.seal_setup

Question 4

When configuring an HSM for Auto-Unseal, which parameter identifies the specific hardware partition to be used?

Accepted Answer

slot. When configuring an HSM for Vault Auto-Unseal, the 'slot' parameter identifies the specific hardware partition (slot) on the HSM where the key material is stored. In PKCS#11 terminology, a slot represents a logical partition or token on the HSM, and Vault uses this parameter to select the correct slot for cryptographic operations.

Answer

token_label

Answer

partition_id

Answer

hsm_id

Question 5

You have configured a PKCS#11 HSM for auto-unseal. During a disaster recovery test, you discover the HSM is unreachable. Vault is currently sealed. What happens when the HSM connectivity is restored?

Accepted Answer

Vault automatically detects the HSM and attempts to unseal.. When Vault is configured with an auto-unseal mechanism such as PKCS#11 HSM, the seal stanza continuously attempts to reach the HSM to retrieve the master key. If the HSM is temporarily unreachable, Vault remains sealed but keeps retrying in the background. Once connectivity is restored, Vault automatically detects the HSM and completes the unseal process without operator intervention.

Answer

Vault will transition to a 'permanently sealed' state and require a re-install.

Answer

The unseal process requires a restart of the Vault service.

Answer

Vault requires a manual 'vault operator unseal' command to trigger a retry.

Question 6

You are configuring Vault to use a PKCS#11 HSM for auto-unseal. You have verified the library path and slot ID. When starting Vault, the service fails with a 'failed to login to HSM' error despite the PIN being correct. Which configuration step is the most likely culprit?

Accepted Answer

The 'hmac_key_label' does not match a key object existing on the HSM.. The `hmac_key_label` must reference an existing HMAC key object on the HSM; if the label doesn't match a key that was generated on the HSM, Vault's PKCS#11 auto-unseal login fails with 'failed to login to HSM' even when the PIN is correct. The key label is used to locate the specific key Vault uses to encrypt/decrypt the root key, so a mismatch prevents the login/key-retrieval step from succeeding.

Answer

The HSM slot is already in use by another Vault instance.

Answer

The 'lib.so' path is pointing to a 32-bit library on a 64-bit system.

Answer

The 'pin' field is missing from the configuration file.

Question 7

When rotating the Master Key while using HSM Auto-Unseal, what happens to the existing HSM key?

Accepted Answer

The HSM key is rotated automatically in the HSM.. Rotating the Master Key creates a new key version inside the HSM or uses a new key, while the old one remains to decrypt previously encrypted data until the rotation process is complete.

Answer

Vault generates a new HSM key and destroys the configuration for the old one.

Answer

The HSM key is immediately deleted to prevent rollback.

Answer

The HSM key is unaffected; only the Vault Master Key changes.

Question 8

You are using Seal Wrap. If you perform a 'vault operator rekey', what happens to the keys protected by Seal Wrap?

Accepted Answer

The new KEK is generated and wrapped by the HSM.. Seal Wrap protects Vault's critical security parameters (including the key ring and the KEK) by wrapping them with an HSM-backed key. When 'vault operator rekey' is executed, Vault generates a new unseal key set and re-encrypts the master key, but the KEK itself is regenerated and immediately wrapped by the HSM so that the new key material remains protected under Seal Wrap. This ensures the rekey operation preserves the HSM-backed protection rather than degrading it.

Answer

Seal Wrap is disabled and must be manually re-enabled.

Answer

Seal Wrap keys are excluded from the rekey process.

Answer

The keys must be manually unwrapped and re-wrapped.

Question 9

Which THREE of the following are required configuration parameters in the 'seal' stanza when using a PKCS#11 HSM?

Accepted Answer

slot. In Vault's PKCS#11 seal configuration, the 'slot' parameter (A) is required because it identifies which HSM slot holds the token and key material the seal should use, and without it Vault cannot locate the correct cryptographic token. The 'hmac_key_label' parameter (D) is required because Vault needs the label of the HSM-resident HMAC key used to compute the integrity HMAC over the barrier keyring during unsealing. The 'lib' parameter (E) is required because it specifies the absolute path to the PKCS#11 provider shared library (e.g., /usr/lib/libpkcs11.so) that Vault loads to communicate with the HSM. 'hsm_type' (B) is not a valid PKCS#11 seal stanza parameter, and 'max_attempts' (C) is not a required PKCS#11 seal configuration field, so neither belongs in the required set.

Answer

hsm_type

Answer

max_attempts

Question 10

Which THREE of the following statements regarding PKCS#11 HSM integration in Vault are correct?

Accepted Answer

The HSM must be pre-provisioned with a key before Vault initialization.. Option A is correct because Vault's PKCS#11 auto-unseal requires the HSM to already contain a pre-provisioned key (the seal key) that Vault references during initialization; Vault does not generate or store that key itself. Option C is correct because the PKCS#11 shared library (e.g., libCryptoki2.so or vendor equivalent) must be readable and loadable by the OS user that runs the vault process, otherwise Vault cannot open the session to the token. Option E is correct because Vault runs as a non-interactive daemon and must log in to the HSM slot programmatically, so the slot/token must permit non-interactive login (typically via a stored PIN in the seal stanza) rather than requiring a human-entered password. Option B is incorrect because a Vault seal stanza supports only one HSM provider/configuration at a time, not multiple concurrent providers. Option D is incorrect because Seal Wrap is an optional Enterprise feature that adds FIPS 140-2 wrapping of barrier data; it is not a prerequisite for PKCS#11 HSM auto-unseal.

Answer

Vault supports multiple concurrent HSM providers in a single stanza.

Answer

Seal Wrap is required for all HSM integrations.

Question 11

Which TWO of the following are benefits of using Seal Wrap in Vault Enterprise?

Accepted Answer

Compliance with FIPS 140-2/3 requirements.. Option A is correct because Seal Wrap in Vault Enterprise leverages HSM-backed AES-256-GCM encryption (via PKCS#11) to wrap the barrier key and other sensitive values, which helps organizations meet FIPS 140-2/3 compliance requirements for cryptographic modules. Option C is correct because with Seal Wrap the encryption keys are wrapped by the HSM and the unwrapped key material is never exposed in plaintext outside the HSM, protecting keys even from Vault itself. The other options do not belong: automatic failover to a standby cluster is a feature of Vault Enterprise replication/HA, not Seal Wrap; increased storage backend performance is unrelated since Seal Wrap adds cryptographic overhead rather than improving throughput; and automatic deletion of audit logs is not a Seal Wrap capability, as audit log retention is controlled by audit device configuration and external log management.

Answer

Automatic failover to a standby Vault cluster.

Answer

Increased storage backend performance.

Answer

Automatic deletion of audit logs.

Question 12

If you need to rotate the key on the HSM used for Seal Wrap, what is the recommended procedure?

Accepted Answer

Use the 'vault operator seal-wrap rekey' command.. The 'vault operator seal-wrap rekey' command (or equivalent rotation process) allows Vault to transition to a new key on the HSM while maintaining access to existing data.

Answer

There is no way to rotate the key; the HSM must be re-initialized.

Answer

Restart Vault with a new 'hmac_key_label'.

Answer

Delete the old key in the HSM and create a new one.

Question 13

Which TWO of the following must be true for Seal Wrap to function correctly?

Accepted Answer

The 'seal_wrap' parameter must be set to 'true' in the configuration.. Seal Wrap requires the seal_wrap parameter to be explicitly set to true in the seal stanza of the Vault configuration, so option A is correct because without this setting Vault will not wrap the relevant key material with the HSM-backed seal. Option B is also correct because Seal Wrap depends on the cluster being initialized with an HSM seal (for example, a PKCS#11 seal), which provides the mechanism that actually performs the wrapping and unwrapping of keys. Option C is incorrect because Seal Wrap does not mandate RSA for all keys; supported HSM seal mechanisms can use other algorithms such as AES, and the requirement is about the seal mechanism, not a specific key algorithm. Option D is incorrect because Seal Wrap is independent of which secrets engines are enabled, so the transit engine need not be the only engine. Option E is incorrect because audit logs are written to configured audit devices and are not sent to the HSM as part of Seal Wrap.

Answer

The HSM must use the RSA algorithm for all keys.

Answer

The transit engine must be the only engine enabled.

Answer

All audit logs must be sent to the HSM.

Question 14

What happens to the Vault audit logs if the HSM becomes unavailable?

Accepted Answer

Vault continues to write audit logs normally.. Vault audit logs are independent of the HSM unseal mechanism. Vault will continue to write logs, provided the storage for audit logs is available.

Answer

Vault encrypts the audit logs with a fallback key.

Answer

Audit logs are buffered in memory until the HSM is back.

Answer

Vault stops writing audit logs immediately.

Question 15

A Vault Enterprise operator is preparing a new cluster for PKCS#11 auto-unseal using a SoftHSM token. After configuring the seal stanza, the operator runs `vault operator init` and receives an error that the HSM key is not found. The operator confirms the token PIN and key label are correct in `vault.hcl`. Which Vault CLI command should the operator run to create the missing encryption key in the HSM before retrying initialization?

Accepted Answer

vault write sys/managed-keys/pkcs11/<key_name> .... When using PKCS#11 auto-unseal, the HSM key must exist before Vault can use it. Vault Enterprise's managed keys feature allows operators to create keys directly in the HSM via the sys/managed-keys/pkcs11 endpoint. This avoids manual HSM key generation and ensures the key label matches the seal stanza configuration. The other commands do not provision HSM keys and would not resolve the missing key error.

Answer

vault operator init -recovery-shares=5 -recovery-threshold=3

Answer

vault write sys/sealwrap/rewrap

Answer

vault operator generate-root -init

Question 16

A Vault Enterprise cluster uses PKCS#11 auto-unseal with an HSM. The security team requires that all Vault data be protected by the HSM even when Vault is unsealed. They enable `seal_wrap = true` in the seal stanza. After a restart, Vault fails to start, and the logs show errors related to seal wrapping. Which two actions should the operator take to resolve the issue? (Choose two.)

Accepted Answer

Ensure that the HSM key specified in the seal stanza has the CKA_WRAP and CKA_UNWRAP attributes set to true.. Seal wrapping requires the HSM to support key wrapping mechanisms and the key to have CKA_WRAP and CKA_UNWRAP attributes enabled. Without these, Vault cannot perform the necessary cryptographic operations and fails to start. Operators must verify HSM capabilities and key attributes. Disabling seal wrapping or altering unrelated parameters does not address the root cause and would compromise the security requirement.

Answer

Disable `seal_wrap` and rely solely on auto-unseal, because seal wrapping is not supported with PKCS#11 HSMs.

Answer

Increase the `hmac_key_label` parameter in the seal stanza to a longer value to accommodate seal wrapping metadata.

Answer

Set `disable_sealwrap = true` in the Vault server configuration to bypass seal wrapping for system paths.

Question 17

A Vault Enterprise administrator is configuring a new Vault cluster to use a PKCS#11 HSM for auto-unseal. The administrator wants to ensure that if the HSM becomes unavailable, Vault can still be unsealed using recovery keys. Which Vault feature must be enabled during initialization to allow this?

Accepted Answer

Recovery keys. When Vault is initialized with auto-unseal, recovery keys are generated instead of unseal keys. These recovery keys can be used to unseal Vault if the HSM is unavailable, and they are also required for certain privileged operations. Enabling recovery keys during initialization (by setting recovery shares and threshold) is essential for disaster recovery when the HSM cannot be reached. Other features like seal wrapping or Shamir shares do not provide this fallback capability.

Answer

Auto-unseal with multiple HSM slots

Answer

Shamir's Secret Sharing

Answer

Seal wrapping

Question 18

A Vault Enterprise cluster uses a PKCS#11 HSM for auto-unseal and Seal Wrap. During a planned HSM firmware upgrade, the HSM vendor tells the administrator that the existing wrapping key must be destroyed and a new one generated. What must the administrator do to keep Vault operational?

Accepted Answer

Run `vault operator rewrap` to migrate existing Seal Wrap data to the new HSM wrapping key, then restart the Vault nodes.. Seal Wrap protects sensitive values by encrypting them with an HSM-backed wrapping key. When the HSM wrapping key is rotated, existing seal-wrapped data must be migrated before the old key is destroyed. The `vault operator rewrap` command performs this migration by decrypting with the old key and re-encrypting with the new key. A rekey or configuration reload does not transform existing Seal Wrap data.

Answer

Take a snapshot of Vault storage, restore it after the HSM upgrade, and let Vault re-establish the wrapping key automatically.

Answer

Rewrap all seal-wrapped data by running `vault operator rekey -target=recovery` and then restart the Vault nodes.

Answer

Update the `seal` stanza in the Vault configuration to point to the new HSM key label and reload Vault with SIGHUP.

Question 19

A Vault Enterprise administrator is deploying a new cluster that will use a PKCS#11 HSM for auto-unseal. The administrator must ensure the Vault process can communicate with the HSM and that the required cryptographic material is available. Which TWO configuration elements are required in the `seal` stanza for PKCS#11 auto-unseal? (Choose two.)

Accepted Answer

`lib` — the path to the PKCS#11 library on the host.. For PKCS#11 auto-unseal, Vault must load the vendor's PKCS#11 library and identify the specific HSM key to use. The `lib` parameter provides the library path, and `key_label` selects the key object. Other parameters like `slot`, `pin`, and `mechanism` are optional because Vault can discover slots, obtain PINs from environment variables, and default to standard mechanisms.

Answer

`pin` — the user PIN to authenticate to the HSM token.

Answer

`slot` — the numeric slot ID where the HSM token is inserted.

Answer

`mechanism` — the cryptographic mechanism Vault should use for wrapping.

Question 20

A Vault Enterprise operator uses Seal Wrap with a PKCS#11 HSM. During a disaster recovery drill, the operator needs to restore a snapshot to a new cluster that uses a different HSM with a different key. What must the operator do to ensure the restored data can be decrypted?

Accepted Answer

Export the seal wrap key from the original HSM and import it into the new HSM before restoring the snapshot.. Seal Wrap uses an HSM-backed key to encrypt Vault's critical security parameters. When migrating to a different HSM, the original key must be transferred to the new HSM to decrypt the wrapped data. Generating a new key, disabling Seal Wrap, or rekeying does not provide the necessary decryption capability.

Answer

Generate a new seal wrap key on the new HSM and update the seal stanza to reference it.

Answer

Disable Seal Wrap on the new cluster before restoring the snapshot.

Answer

Restore the snapshot and then rekey Vault using the new HSM's key.