VA-003 Explain encryption as a service Practice Test 2 — 15 Questions

Question 1

Match each Vault response wrapping feature to its description.

Accepted Answer

Response Wrapping Token: A single-use token that encapsulates a response, used to securely transfer secrets.. In Vault, response wrapping uses a single-use token with a cubbyhole to store secrets, and the TTL determines its validity. Common confusions include thinking the token can be reused or that cubbyhole is a replicated storage engine.

Answer

Response Wrapping Token: A token that never expires and can be used multiple times.

Answer

Cubbyhole: A secret storage engine that replicates to all nodes in a cluster.

Answer

TTL: The number of times a wrapped response can be unwrapped before it expires.

Question 2

A developer wants to encrypt a password before storing it in a database. The encryption must be deterministic so that the same plaintext always produces the same ciphertext. Which encryption mode should be used in the transit secrets engine?

Accepted Answer

convergent-encryption. The transit secrets engine in Vault supports convergent encryption, which is a deterministic encryption mode where the same plaintext and context always produce the same ciphertext. This is achieved by using the plaintext itself as part of the encryption key derivation, ensuring repeatable output. The question specifically requires deterministic encryption, making convergent encryption the correct choice.

Answer

chacha20-poly1305

Answer

aes128-gcm96

Answer

aes-gcm

Answer

padding

Question 3

A DevOps team needs to encrypt large files (several GB) using Vault's transit engine. What is the recommended approach?

Accepted Answer

Use Vault's datakey endpoint to get a data encryption key, encrypt locally, then wrap with Vault. The transit engine is designed for encrypting small data payloads (typically a few KB), not multi-GB files. The recommended approach is to use the `/transit/datakey/plaintext` endpoint to generate a data encryption key (DEK), encrypt the large file locally with that DEK using a symmetric algorithm like AES-256-GCM, and then wrap (encrypt) the DEK with Vault using the transit engine. This keeps the large file out of Vault while still leveraging Vault for key management and audit logging.

Answer

Use Vault's batch encryption

Answer

Use Vault's seal-wrapping feature

Answer

Encrypt the file directly with Vault's transit encrypt API

Answer

Split the file into chunks and encrypt each chunk via transit

Question 4

A team has set up automatic key rotation on a transit key. After rotation, encrypted data that was encrypted with the previous key version can no longer be decrypted. What is the most likely cause?

Accepted Answer

The key's min_decryption_version is set too high. The `min_decryption_version` setting on a transit key in Vault's transit secrets engine controls the minimum key version that can be used to decrypt ciphertext. If this value is set too high (e.g., to the current version), older key versions are effectively disabled for decryption, causing any data encrypted with a previous key version to become undecryptable. This is a common misconfiguration when automating key rotation without properly managing version policies in Vault.

Answer

The key was deleted

Answer

The key's min_encryption_version is set too high

Answer

The team used the 'rewrap' operation incorrectly

Answer

The key is not exportable

Question 5

What is the primary purpose of the Vault transit secrets engine?

Accepted Answer

Encryption and decryption as a service. The Vault transit secrets engine is designed to provide encryption and decryption as a service, allowing applications to encrypt and decrypt data without managing cryptographic keys directly. It offloads the cryptographic operations to Vault, which securely stores and rotates the encryption keys, ensuring that plaintext data never leaves the application unencrypted. This enables centralized key management and policy-based access control for encryption operations.

Answer

Token generation

Answer

Certificate management

Answer

Dynamic database credentials

Answer

Secure storage of secrets

Question 6

A security policy requires that encryption keys used in transit must never leave Vault's memory. However, development teams need to perform encryption offline in CI/CD pipelines. How can this be accomplished?

Accepted Answer

Use Vault's datakey endpoint to get a wrapped key that can be unwrapped offline. Vault's `datakey` endpoint generates a data encryption key (DEK) that is wrapped by a Vault-managed key. The wrapped DEK can be safely stored and used offline in CI/CD pipelines, while the unwrapped key material never leaves Vault's memory — the DEK is unwrapped only when needed, and the wrapping key remains in Vault. This satisfies the policy requirement that encryption keys used in transit must never leave Vault's memory, as the DEK itself is not a transit key but a data key that can be used offline.

Answer

Use exportable keys and export them

Answer

Use Vault's transit encrypt with context

Answer

Use Vault's ciphertext rewrap

Answer

It is not possible; keys must stay in Vault

Question 7

A user receives an error 'invalid ciphertext' when trying to decrypt data. The ciphertext was created by another Vault instance. What is the most likely issue?

Accepted Answer

The ciphertext includes key version info that doesn't match. Vault's transit secrets engine appends key version information to the ciphertext by default. When decrypting, Vault checks that the key version embedded in the ciphertext matches a version of the key that exists in the destination Vault instance. If the ciphertext was created by a different Vault instance with a different key version history, the version embedded in the ciphertext will not correspond to any known key version, causing the 'invalid ciphertext' error.

Answer

Different key names

Answer

The Vault instance is sealed

Answer

Different key types

Answer

The user lacks permissions to decrypt

Question 8

Which Vault API path is used to encrypt data with the transit engine?

Accepted Answer

/v1/transit/encrypt/{keyname}. The Vault transit engine uses the exact path `/v1/transit/encrypt/{keyname}` to encrypt plaintext data. The `{keyname}` parameter specifies the named encryption key stored in the transit engine, and the API endpoint expects a POST request with the plaintext base64-encoded in the request body. This path aligns with Vault's RESTful design where the action (`encrypt`) is a sub-path under the transit mount, and the key name is a required path parameter.

Answer

/v1/transit/enc/

Answer

/v1/transit/encrypt/

Answer

/v1/transit/encryption/

Answer

/v1/transit/encryption/{keyname}

Question 9

An organization wants to ensure that even Vault administrators cannot see the plaintext of data encrypted with the transit engine, but they want to use Vault for key management. What feature should be enabled?

Accepted Answer

Client-side encryption with datakey. Client-side encryption with a datakey allows the application to encrypt data locally using a key obtained from Vault, ensuring that Vault administrators never see the plaintext. The datakey is generated by Vault and returned in both plaintext and ciphertext forms; the application encrypts data with the plaintext key and then discards it, storing only the ciphertext key alongside the encrypted data. This decouples key management from data encryption, meeting the requirement that even Vault administrators cannot access the plaintext.

Answer

Seal wrapping

Answer

Convergent encryption

Answer

Key deletion prevention

Answer

Key derivation

Question 10

A company uses Vault transit to encrypt secrets. They want to periodically rotate the encryption key to comply with compliance requirements. Which TWO actions should be taken? (Choose two.)

Accepted Answer

Rewrap all existing ciphertext with the new key version.. Vault's `vault rewrap` command re-encrypts existing ciphertext with the latest key version without decrypting the underlying plaintext, preserving the data's confidentiality. This is essential after a key rotation to ensure all ciphertext uses the new key, meeting compliance requirements for periodic key rotation.

Answer

Update the min_decryption_version to the newest version immediately.

Answer

Export the key and re-encrypt all data manually.

Answer

Delete old key versions after rotation.

Question 11

An application uses transit encryption with convergent encryption enabled. Which THREE statements are true about convergent encryption? (Choose three.)

Accepted Answer

It produces the same ciphertext for the same plaintext and context.. Convergent encryption derives the encryption key from the plaintext content itself, typically by hashing the plaintext. Because the same plaintext always produces the same key, and the encryption algorithm is deterministic (no random nonce), the resulting ciphertext is identical for identical plaintexts. This property directly enables deduplication of encrypted data, as identical ciphertexts can be identified and stored only once.

Answer

It requires a separate key for each context.

Answer

It is typically slower than non-convergent encryption.

Question 12

Which THREE are valid operations in the Vault transit secrets engine? (Choose three.)

Accepted Answer

rewrap. The Vault transit secrets engine provides encryption as a service, and its core operations are encrypt, decrypt, rewrap, and datakey generation. Rewrap is valid because it decrypts ciphertext and re-encrypts it with the latest key version without exposing the plaintext to the caller, maintaining security during key rotation.

Answer

issue

Answer

revoke

Question 13

Refer to the exhibit. What is the purpose of the -field=ciphertext flag in this command?

Accepted Answer

It instructs Vault to only return the ciphertext field from the response.. The `-field=ciphertext` flag in a Vault command instructs the CLI to extract and return only the value of the `ciphertext` key from the JSON response object. This is a standard Vault output filtering mechanism that allows users to isolate a specific field without parsing the full response, which is especially useful in scripting and automation.

Answer

It sets the ciphertext field for encryption.

Answer

It enables field-level encryption.

Answer

It specifies the encryption key name.

Answer

It outputs the command result to a file named ciphertext.

Question 14

Refer to the exhibit. Based on this policy, which actions can the associated token perform? (Assume all paths exist.)

Accepted Answer

Create, read, update, delete keys; encrypt and decrypt data.. The exhibit shows a policy that grants the 'manage' capability on a key, which in Vault (the implied technology) includes create, read, update, and delete operations. Additionally, the policy includes 'encrypt' and 'decrypt' capabilities, allowing the token to perform both key management and cryptographic operations. Therefore, the token can create, read, update, delete keys, and encrypt/decrypt data.

Answer

Only encrypt and decrypt data.

Answer

Create and read keys, encrypt and decrypt data.

Answer

Only manage keys, not encrypt/decrypt.

Answer

Create keys only.

Question 15

Refer to the exhibit. What does min_decryption_version = 1 indicate?

Accepted Answer

Version 1 is the minimum version that can be used for decryption.. In Vault Enterprise, the `min_decryption_version` parameter on a transit key specifies the lowest key version that is allowed to decrypt existing ciphertext. Setting `min_decryption_version = 1` means that any key version from 1 up to the current version can be used for decryption; version 1 is the minimum allowed. This ensures backward compatibility while allowing newer versions to be used for encryption.

Answer

Data encrypted with version 1 can only be decrypted with version 1.

Answer

Only data encrypted with version 1 or higher can be decrypted.

Answer

All ciphertext must be rewrapped to version 1.

Answer

Version 1 keys are not allowed for decryption.