VA-003 Explain encryption as a service — 20 Questions

Question 1

Which TWO capabilities are required in a Vault policy to allow a client to encrypt data using a key named 'app-key' in the transit engine? (Assume the key already exists.)

Accepted Answer

encrypt on /transit/encrypt/app-key. To encrypt data using a key in the transit engine, a client only needs the 'encrypt' capability on the path `/transit/encrypt/app-key`. The 'read' capability on `/transit/keys/app-key` is not required for encryption; it is only needed for reading key metadata (e.g., key type, creation time). The other capabilities ('update', 'create', 'list') are also unnecessary and would instead allow modifying or listing keys.

Answer

read on /transit/keys/app-key

Answer

update on /transit/keys/app-key

Answer

create on /transit/keys/app-key

Answer

list on /transit/keys/app-key

Question 2

An application needs to encrypt credit card numbers. The encryption must be deterministic for indexing purposes but also support key rotation. Which approach should be used?

Accepted Answer

Use convergent encryption with key rotation. Convergent encryption (Option D) uses a hash of the plaintext as the encryption key, ensuring the same credit card number always produces the same ciphertext, which is required for deterministic indexing. Key rotation is supported by re-encrypting data with a new key derived from the data using a different algorithm or salt. This allows both determinism and rotatability, unlike standard encryption (Option E) which is not inherently deterministic, and unlike datakey encryption (Option C) which typically involves wrapping a data encryption key rather than deriving keys from the data itself.

Answer

Use Vault's cubbyhole

Answer

Use Vault's transformations engine

Answer

Use datakey encryption

Answer

Use standard encryption and re-encrypt all data on rotation

Question 3

A company is using Vault Transit to encrypt files before uploading them to an S3 bucket. They notice that for a given plaintext file, the ciphertext output is always identical, even when encrypting at different times. They are using the `encrypt` endpoint with the default AES-GCM algorithm. The team is concerned about security because the repeated ciphertext leaks information (e.g., file equality). What is the most likely cause of this behavior?

Accepted Answer

They are using convergent encryption. Convergent encryption is a deterministic scheme where the encryption key is derived from the hash of the plaintext. This causes identical plaintexts to produce identical ciphertexts, regardless of when encryption occurs. The default AES-GCM algorithm in Vault Transit uses a random nonce each time, which would normally produce different ciphertexts for the same plaintext. However, if convergent encryption is enabled, the nonce is derived from the plaintext hash, leading to the observed behavior. The security concern is that repeated ciphertexts reveal file equality, which is a known property of convergent encryption used for deduplication.

Answer

They are using the wrong key

Answer

They are using a deterministic encryption scheme

Answer

They are not providing an encryption context

Question 4

A healthcare application needs to encrypt sensitive patient data before storing it in a legacy database that does not support encryption. The team wants to use Vault's encryption as a service. However, the application is running on a restricted network that cannot make outbound HTTP requests to Vault. Which solution should the team implement?

Accepted Answer

Deploy Vault Agent in sidecar mode with a configured encrypt stanza to handle encryption locally.. Vault Agent in sidecar mode runs alongside the application on the same host, handling encryption locally without requiring outbound HTTP requests. The encrypt stanza in the agent configuration allows it to proxy encryption operations to Vault's transit secrets engine, while the application communicates with the agent over a local loopback interface, bypassing network restrictions.

Answer

Set up Vault replication from a central Vault to a local Vault instance.

Answer

Use Vault's HTTP API from the application to encrypt data directly.

Answer

Enable the transit secrets engine and call Vault's encrypt endpoint.

Question 5

A DevOps team uses Vault's transit engine to encrypt secrets in CI/CD pipelines. They report that encryption operations are failing with 'permission denied' errors. The team has a policy granting 'create' and 'update' capabilities on the transit key path. What is the most likely missing capability?

Accepted Answer

The 'encrypt' capability is missing.. The Vault transit engine uses distinct capabilities for key management versus data operations. 'Create' and 'update' allow managing the key itself (e.g., creating or rotating the key), but encryption of data requires the 'encrypt' capability on the transit key path. Without 'encrypt', the API call to encrypt data fails with a 'permission denied' error, even if the key exists and is properly configured.

Answer

The 'read' capability is missing.

Answer

The 'delete' capability is missing.

Answer

The 'list' capability is missing.

Question 6

A developer wants to encrypt data using Vault's transit engine with a key named 'payment-key'. The key already exists and is set to allow encryption. Which API path should the developer use to encrypt the data?

Accepted Answer

POST /v1/transit/encrypt/payment-key. The Vault transit engine exposes the `/v1/transit/encrypt/<key_name>` endpoint for encrypting plaintext data using a named encryption key. Since the key 'payment-key' already exists and is allowed to encrypt, a POST request to this path will perform the encryption operation and return the ciphertext.

Answer

POST /v1/transit/decrypt/payment-key

Answer

POST /v1/transit/rewrap/payment-key

Answer

POST /v1/transit/keys/payment-key

Question 7

An organization wants to encrypt data at rest in a cloud storage bucket. They plan to use Vault's transit engine to generate a data key and then encrypt the data locally. Which transit endpoint should they use to get a data key?

Accepted Answer

POST /v1/transit/datakey/plaintext/my-key. The correct endpoint to retrieve a data key that can be used for local client-side encryption is POST /v1/transit/datakey/plaintext/my-key. This endpoint returns both the plaintext data key (for local encryption) and the ciphertext version of the key (for secure storage alongside the encrypted data). The 'plaintext' in the path indicates that the response includes the key in plaintext form, which is necessary for performing encryption locally.

Answer

POST /v1/transit/encrypt/my-key

Answer

POST /v1/transit/decrypt/my-key

Answer

POST /v1/transit/datakey/ciphertext/my-key

Question 8

Which TWO statements are true about Vault's encryption as a service using the transit engine?

Accepted Answer

Data encrypted with a key can be decrypted with a later version of the same key if the key is rotated. [CORRECT]. Options B and C are correct. Option B is correct because the transit engine retains old key versions after rotation, allowing decryption of data encrypted with previous versions. Option C is correct because the transit engine supports convergent encryption, which allows encrypting the same plaintext with the same key to produce the same ciphertext, enabling deduplication. Option A is incorrect because keys can be rotated. Option D is incorrect because Vault does not store plaintext data; it only performs encryption/decryption without storing data. Option E is incorrect because Vault does not allow clients to provide their own key material; keys are generated internally by Vault.

Answer

Encryption keys cannot be rotated once created. [wrong]

Answer

Vault stores the plaintext data for audit purposes. [wrong]

Answer

Clients can provide their own key material when creating a key. [CORRECT]

Question 9

A multinational corporation uses Vault Enterprise with the transit engine to encrypt sensitive financial data across multiple cloud regions. Each region has its own Vault cluster, and they use performance replication to synchronize transit keys. Recently, the team in the Asia-Pacific region reports that encryption operations are slower than in other regions. They also notice that some decryption requests for data encrypted with a key that was rotated in the primary region are failing with 'key version not found' errors. The transit key is named 'fin-key' and has been rotated three times. The Asia-Pacific cluster is up-to-date with replication according to the replication status dashboard. Which action should the operations team take to resolve the decryption failures?

Accepted Answer

Verify that the policy in the Asia-Pacific cluster grants 'decrypt' capability on the key path for older key versions.. The decryption failures are caused by missing key versions in the Asia-Pacific cluster's transit engine. Even though performance replication synchronizes transit keys, older key versions may not be replicated if the transit engine's key version caching or policy does not explicitly grant access to them. Verifying that the policy includes 'decrypt' capability on the key path for older key versions ensures that the cluster can serve decryption requests for data encrypted with rotated keys.

Answer

Increase the performance standby count in the Asia-Pacific cluster.

Answer

Manually copy the key material from the primary to the secondary cluster.

Answer

Re-encrypt all data encrypted with version 1 of 'fin-key' using the current version.

Question 10

A DevOps team needs to encrypt sensitive configuration data before storing it in a version control system. They want to use Vault's encryption as a service to encrypt the data using a named encryption key. Which Vault path should they use to perform the encryption?

Accepted Answer

POST /v1/transit/encrypt/my-key. The correct path for encrypting data using Vault's encryption-as-a-service is POST /v1/transit/encrypt/my-key. The Transit secrets engine provides encryption as a service, and the /encrypt endpoint is specifically designed to encrypt plaintext data using a named encryption key. The key name 'my-key' in the path identifies which key in the Transit engine should be used for the encryption operation.

Answer

POST /v1/transit/sign/my-key

Answer

POST /v1/transit/hmac/my-key

Answer

POST /v1/transit/random

Answer

POST /v1/transit/decrypt/my-key

Question 11

Which TWO statements correctly describe Vault's encryption as a service using the Transit secrets engine?

Accepted Answer

Data is encrypted and decrypted on the server side without the client having direct access to the encryption key.. The Transit secrets engine in Vault performs encryption and decryption on the server side, meaning the client sends plaintext to Vault and receives ciphertext back without ever having direct access to the underlying encryption key. This is the core of encryption as a service: the key remains securely stored within Vault's barrier, and the client only interacts with the key via API calls, never seeing the key material itself.

Answer

Ciphertext is stored within Vault for later retrieval.

Answer

Encryption always produces a unique ciphertext even with the same plaintext and key.

Answer

Key rotation is not supported; the key version is fixed.

Question 12

After rotating the 'payment-key', Vault successfully decrypts data encrypted with the old key (v1). What is the most likely reason the decryption succeeded?

Accepted Answer

The old key version is retained and used for decryption when the ciphertext references that version.. A is correct because Vault uses key versioning: when a key is rotated, the old key version (v1) is retained for decryption purposes. The ciphertext includes metadata referencing the key version used for encryption, so Vault automatically selects the correct old key version to decrypt data encrypted before rotation. This ensures backward compatibility without re-encrypting existing data.

Answer

The old key version is automatically deleted after rotation, but the ciphertext contains the key version and is decrypted by the new key.

Answer

The ciphertext contains the original plaintext, so decryption simply extracts it.

Answer

The plaintext is stored in Vault during encryption, so decryption retrieves the stored plaintext.

Question 13

A DevOps team needs to implement encryption as a service for application data stored in a PostgreSQL database. They want to use Vault's transit secrets engine to encrypt sensitive fields before storage. Which TWO actions should the team take to ensure the encryption keys are rotated automatically and securely?

Accepted Answer

Use a key derivation function with a unique context per application context to ensure each encryption produces distinct ciphertext.. Using a key derivation function (KDF) with a unique context per application ensures that each encryption operation produces distinct ciphertext even if the same plaintext and key are used. This prevents ciphertext correlation attacks and is a recommended practice when encrypting many records with the same key. Option E is correct because Vault's transit secrets engine supports the 'auto_rotate_period' parameter, which allows you to set a time-based automatic rotation schedule for the encryption key, ensuring keys are rotated without manual intervention.

Answer

Set 'min_decryption_version' to the latest key version to force re-encryption of old data.

Answer

Disable key rotation and rely on manual key updates using the transit key/rotate endpoint.

Answer

Restrict access to the decryption capability to prevent adversaries from learning the key material.

Question 14

A financial technology company uses Vault Enterprise to manage encryption keys for its payment processing system. The system uses the transit secrets engine to encrypt credit card numbers before storing them in a legacy database. The security team mandates that all encryption keys must be automatically rotated every 30 days. The operations team configures the key 'payment-cards' with 'auto_rotate_period' set to 30 days. After the first rotation, the payment processing application starts failing with 'permission denied' errors when trying to decrypt previously encrypted data. The application uses a token with a policy that grants 'create' and 'update' capabilities on 'transit/decrypt/payment-cards'. The application does not use the 'rewrap' endpoint. The Vault audit logs show that the decryption requests are being made to the correct path. What is the most likely cause of the failure?

Accepted Answer

The application is not specifying the key version in the decryption request, and Vault defaults to the latest key version which cannot decrypt data encrypted with the old version.. When Vault rotates a key in the transit secrets engine, it creates a new key version but retains the old version for decryption of existing ciphertexts. By default, decryption requests that do not specify a key version use the latest version, which cannot decrypt data encrypted with an older version. The application must explicitly include the `?version=` parameter or use the ciphertext's embedded version information to target the correct key version for decryption.

Answer

The key rotation changed the encryption algorithm, making old ciphertexts incompatible with the new key.

Answer

The application's token has expired after the key rotation, requiring a new token with updated policies.

Answer

The application must use the 'rewrap' endpoint to re-encrypt all ciphertexts with the new key version before decryption.

Question 15

Drag and drop the steps to configure Vault's AWS secrets engine to generate IAM credentials into the correct order.

Accepted Answer

Enable the AWS secrets engine, then configure the root IAM credentials, then create a role, then generate IAM credentials, then rotate root credentials.. The correct sequence for configuring Vault's AWS secrets engine to generate IAM credentials is: first enable the AWS secrets engine at a path, then configure the root IAM credentials that Vault will use to interact with AWS, then create a role that defines the permissions for generated credentials, then generate the actual IAM credentials using that role, and finally rotate the root credentials to enhance security. This order ensures that each step's prerequisites are met.

Answer

Enable the AWS secrets engine, then configure the root IAM credentials, then generate IAM credentials, then create a role, then rotate root credentials.

Answer

Enable the AWS secrets engine, then create a role, then configure the root IAM credentials, then generate IAM credentials, then rotate root credentials.

Answer

Configure the root IAM credentials, then enable the AWS secrets engine, then create a role, then generate IAM credentials, then rotate root credentials.

Question 16

Match each Vault response wrapping feature to its description.

Accepted Answer

Response Wrapping Token: A single-use token that encapsulates a response, used to securely transfer secrets.. In Vault, response wrapping uses a single-use token with a cubbyhole to store secrets, and the TTL determines its validity. Common confusions include thinking the token can be reused or that cubbyhole is a replicated storage engine.

Answer

Response Wrapping Token: A token that never expires and can be used multiple times.

Answer

Cubbyhole: A secret storage engine that replicates to all nodes in a cluster.

Answer

TTL: The number of times a wrapped response can be unwrapped before it expires.

Question 17

A developer wants to encrypt a password before storing it in a database. The encryption must be deterministic so that the same plaintext always produces the same ciphertext. Which encryption mode should be used in the transit secrets engine?

Accepted Answer

convergent-encryption. The transit secrets engine in Vault supports convergent encryption, which is a deterministic encryption mode where the same plaintext and context always produce the same ciphertext. This is achieved by using the plaintext itself as part of the encryption key derivation, ensuring repeatable output. The question specifically requires deterministic encryption, making convergent encryption the correct choice.

Answer

chacha20-poly1305

Answer

aes128-gcm96

Answer

aes-gcm

Answer

padding

Question 18

A DevOps team needs to encrypt large files (several GB) using Vault's transit engine. What is the recommended approach?

Accepted Answer

Use Vault's datakey endpoint to get a data encryption key, encrypt locally, then wrap with Vault. The transit engine is designed for encrypting small data payloads (typically a few KB), not multi-GB files. The recommended approach is to use the `/transit/datakey/plaintext` endpoint to generate a data encryption key (DEK), encrypt the large file locally with that DEK using a symmetric algorithm like AES-256-GCM, and then wrap (encrypt) the DEK with Vault using the transit engine. This keeps the large file out of Vault while still leveraging Vault for key management and audit logging.

Answer

Use Vault's batch encryption

Answer

Use Vault's seal-wrapping feature

Answer

Encrypt the file directly with Vault's transit encrypt API

Answer

Split the file into chunks and encrypt each chunk via transit

Question 19

A team has set up automatic key rotation on a transit key. After rotation, encrypted data that was encrypted with the previous key version can no longer be decrypted. What is the most likely cause?

Accepted Answer

The key's min_decryption_version is set too high. The `min_decryption_version` setting on a transit key in Vault's transit secrets engine controls the minimum key version that can be used to decrypt ciphertext. If this value is set too high (e.g., to the current version), older key versions are effectively disabled for decryption, causing any data encrypted with a previous key version to become undecryptable. This is a common misconfiguration when automating key rotation without properly managing version policies in Vault.

Answer

The key was deleted

Answer

The key's min_encryption_version is set too high

Answer

The team used the 'rewrap' operation incorrectly

Answer

The key is not exportable

Question 20

What is the primary purpose of the Vault transit secrets engine?

Accepted Answer

Encryption and decryption as a service. The Vault transit secrets engine is designed to provide encryption and decryption as a service, allowing applications to encrypt and decrypt data without managing cryptographic keys directly. It offloads the cryptographic operations to Vault, which securely stores and rotates the encryption keys, ensuring that plaintext data never leaves the application unencrypted. This enables centralized key management and policy-based access control for encryption operations.

Answer

Token generation

Answer

Certificate management

Answer

Dynamic database credentials

Answer

Secure storage of secrets