VA-003 Explain encryption as a service — Timed 20 Questions

Question 1

A healthcare application needs to encrypt sensitive patient data before storing it in a legacy database that does not support encryption. The team wants to use Vault's encryption as a service. However, the application is running on a restricted network that cannot make outbound HTTP requests to Vault. Which solution should the team implement?

Accepted Answer

Deploy Vault Agent in sidecar mode with a configured encrypt stanza to handle encryption locally.. Option B is correct because Vault Agent in sidecar mode runs alongside the application on the same host, handling encryption locally without requiring outbound HTTP requests. The encrypt stanza in the agent configuration allows it to proxy encryption operations to Vault's transit secrets engine, while the application communicates with the agent over a local loopback interface, bypassing network restrictions.

Answer

Set up Vault replication from a central Vault to a local Vault instance.

Answer

Use Vault's HTTP API from the application to encrypt data directly.

Answer

Enable the transit secrets engine and call Vault's encrypt endpoint.

Question 2

A DevOps team uses Vault's transit engine to encrypt secrets in CI/CD pipelines. They report that encryption operations are failing with 'permission denied' errors. The team has a policy granting 'create' and 'update' capabilities on the transit key path. What is the most likely missing capability?

Accepted Answer

The 'encrypt' capability is missing.. The Vault transit engine uses distinct capabilities for key management versus data operations. 'Create' and 'update' allow managing the key itself (e.g., creating or rotating the key), but encryption of data requires the 'encrypt' capability on the transit key path. Without 'encrypt', the API call to encrypt data fails with a 'permission denied' error, even if the key exists and is properly configured.

Answer

The 'read' capability is missing.

Answer

The 'delete' capability is missing.

Answer

The 'list' capability is missing.

Question 3

A developer wants to encrypt data using Vault's transit engine with a key named 'payment-key'. The key already exists and is set to allow encryption. Which API path should the developer use to encrypt the data?

Accepted Answer

POST /v1/transit/encrypt/payment-key. Option D is correct because the Vault transit engine exposes the `/v1/transit/encrypt/<key_name>` endpoint for encrypting plaintext data using a named encryption key. Since the key 'payment-key' already exists and is allowed to encrypt, a POST request to this path will perform the encryption operation and return the ciphertext.

Answer

POST /v1/transit/decrypt/payment-key

Answer

POST /v1/transit/rewrap/payment-key

Answer

POST /v1/transit/keys/payment-key

Question 4

An organization wants to encrypt data at rest in a cloud storage bucket. They plan to use Vault's transit engine to generate a data key and then encrypt the data locally. Which transit endpoint should they use to get a data key?

Accepted Answer

POST /v1/transit/datakey/plaintext/my-key. The correct endpoint to retrieve a data key that can be used for local client-side encryption is POST /v1/transit/datakey/plaintext/my-key. This endpoint returns both the plaintext data key (for local encryption) and the ciphertext version of the key (for secure storage alongside the encrypted data). The 'plaintext' in the path indicates that the response includes the key in plaintext form, which is necessary for performing encryption locally.

Answer

POST /v1/transit/encrypt/my-key

Answer

POST /v1/transit/decrypt/my-key

Answer

POST /v1/transit/datakey/ciphertext/my-key

Question 5

Which TWO capabilities are required in a Vault policy to allow a client to encrypt data using a key named 'app-key' in the transit engine? (Assume the key already exists.)

Accepted Answer

read on /transit/keys/app-key. Option A is correct because the 'read' capability on the policy path `/transit/keys/app-key` is required for the client to retrieve the public key information or verify the key exists before encryption. Option B is correct because the 'encrypt' capability on the path `/transit/encrypt/app-key` is the specific permission needed to submit data to the transit engine's encryption endpoint, which uses the named key to perform the encryption operation.

Answer

update on /transit/keys/app-key

Answer

create on /transit/keys/app-key

Answer

list on /transit/keys/app-key

Question 6

Which THREE statements are true about Vault's encryption as a service using the transit engine?

Accepted Answer

Data encrypted with a key can be decrypted with a later version of the same key if the key is rotated.. Option B is correct because Vault's transit engine supports key rotation while maintaining the ability to decrypt data encrypted with previous key versions. When a key is rotated, Vault creates a new version of the key, but the old version is retained for decryption purposes. This allows clients to decrypt ciphertext that was encrypted with an earlier key version, ensuring data remains accessible after rotation.

Answer

Encryption keys cannot be rotated once created.

Answer

Vault stores the plaintext data for audit purposes.

Question 7

A multinational corporation uses Vault Enterprise with the transit engine to encrypt sensitive financial data across multiple cloud regions. Each region has its own Vault cluster, and they use performance replication to synchronize transit keys. Recently, the team in the Asia-Pacific region reports that encryption operations are slower than in other regions. They also notice that some decryption requests for data encrypted with a key that was rotated in the primary region are failing with 'key version not found' errors. The transit key is named 'fin-key' and has been rotated three times. The Asia-Pacific cluster is up-to-date with replication according to the replication status dashboard. Which action should the operations team take to resolve the decryption failures?

Accepted Answer

Verify that the policy in the Asia-Pacific cluster grants 'decrypt' capability on the key path for older key versions.. The decryption failures are caused by missing key versions in the Asia-Pacific cluster's transit engine. Even though performance replication synchronizes transit keys, older key versions may not be replicated if the transit engine's key version caching or policy does not explicitly grant access to them. Verifying that the policy includes 'decrypt' capability on the key path for older key versions ensures that the cluster can serve decryption requests for data encrypted with rotated keys.

Answer

Increase the performance standby count in the Asia-Pacific cluster.

Answer

Manually copy the key material from the primary to the secondary cluster.

Answer

Re-encrypt all data encrypted with version 1 of 'fin-key' using the current version.

Question 8

A DevOps team needs to encrypt sensitive configuration data before storing it in a version control system. They want to use Vault's encryption as a service to encrypt the data using a named encryption key. Which Vault path should they use to perform the encryption?

Accepted Answer

POST /v1/transit/encrypt/my-key. The correct path for encrypting data using Vault's encryption-as-a-service is POST /v1/transit/encrypt/my-key. The Transit secrets engine provides encryption as a service, and the /encrypt endpoint is specifically designed to encrypt plaintext data using a named encryption key. The key name 'my-key' in the path identifies which key in the Transit engine should be used for the encryption operation.

Answer

POST /v1/transit/sign/my-key

Answer

POST /v1/transit/hmac/my-key

Answer

POST /v1/transit/random

Answer

POST /v1/transit/decrypt/my-key

Question 9

Which TWO statements correctly describe Vault's encryption as a service using the Transit secrets engine?

Accepted Answer

Data is encrypted and decrypted on the server side without the client having direct access to the encryption key.. Option B is correct because the Transit secrets engine in Vault performs encryption and decryption on the server side, meaning the client sends plaintext to Vault and receives ciphertext back without ever having direct access to the underlying encryption key. This is the core of encryption as a service: the key remains securely stored within Vault's barrier, and the client only interacts with the key via API calls, never seeing the key material itself.

Answer

Ciphertext is stored within Vault for later retrieval.

Answer

Encryption always produces a unique ciphertext even with the same plaintext and key.

Answer

Key rotation is not supported; the key version is fixed.

Question 10

After rotating the 'payment-key', Vault successfully decrypts data encrypted with the old key (v1). What is the most likely reason the decryption succeeded?

Accepted Answer

The old key version is retained and used for decryption when the ciphertext references that version.. A is correct because Vault uses key versioning: when a key is rotated, the old key version (v1) is retained for decryption purposes. The ciphertext includes metadata referencing the key version used for encryption, so Vault automatically selects the correct old key version to decrypt data encrypted before rotation. This ensures backward compatibility without re-encrypting existing data.

Answer

The old key version is automatically deleted after rotation, but the ciphertext contains the key version and is decrypted by the new key.

Answer

The ciphertext contains the original plaintext, so decryption simply extracts it.

Answer

The plaintext is stored in Vault during encryption, so decryption retrieves the stored plaintext.

Question 11

A DevOps team needs to implement encryption as a service for application data stored in a PostgreSQL database. They want to use Vault's transit secrets engine to encrypt sensitive fields before storage. Which TWO actions should the team take to ensure the encryption keys are rotated automatically and securely?

Accepted Answer

Use a key derivation function with a unique context per application context to ensure each encryption produces distinct ciphertext.. Option B is correct because using a key derivation function (KDF) with a unique context per application ensures that each encryption operation produces distinct ciphertext even if the same plaintext and key are used. This prevents ciphertext correlation attacks and is a recommended practice when encrypting many records with the same key. Option E is correct because Vault's transit secrets engine supports the 'auto_rotate_period' parameter, which allows you to set a time-based automatic rotation schedule for the encryption key, ensuring keys are rotated without manual intervention.

Answer

Set 'min_decryption_version' to the latest key version to force re-encryption of old data.

Answer

Disable key rotation and rely on manual key updates using the transit key/rotate endpoint.

Answer

Restrict access to the decryption capability to prevent adversaries from learning the key material.

Question 12

A financial technology company uses Vault Enterprise to manage encryption keys for its payment processing system. The system uses the transit secrets engine to encrypt credit card numbers before storing them in a legacy database. The security team mandates that all encryption keys must be automatically rotated every 30 days. The operations team configures the key 'payment-cards' with 'auto_rotate_period' set to 30 days. After the first rotation, the payment processing application starts failing with 'permission denied' errors when trying to decrypt previously encrypted data. The application uses a token with a policy that grants 'create' and 'update' capabilities on 'transit/decrypt/payment-cards'. The application does not use the 'rewrap' endpoint. The Vault audit logs show that the decryption requests are being made to the correct path. What is the most likely cause of the failure?

Accepted Answer

The application is not specifying the key version in the decryption request, and Vault defaults to the latest key version which cannot decrypt data encrypted with the old version.. Option D is correct because when Vault rotates a key in the transit secrets engine, it creates a new key version but retains the old version for decryption of existing ciphertexts. By default, decryption requests that do not specify a key version use the latest version, which cannot decrypt data encrypted with an older version. The application must explicitly include the `?version=` parameter or use the ciphertext's embedded version information to target the correct key version for decryption.

Answer

The key rotation changed the encryption algorithm, making old ciphertexts incompatible with the new key.

Answer

The application's token has expired after the key rotation, requiring a new token with updated policies.

Answer

The application must use the 'rewrap' endpoint to re-encrypt all ciphertexts with the new key version before decryption.

Question 13

Drag and drop the steps to configure Vault's AWS secrets engine to generate IAM credentials into the correct order.

Question 14

Match each Vault response wrapping feature to its description.

Question 15

A developer wants to encrypt a password before storing it in a database. The encryption must be deterministic so that the same plaintext always produces the same ciphertext. Which encryption mode should be used in the transit secrets engine?

Accepted Answer

convergent-encryption. The transit secrets engine in Vault supports convergent encryption, which is a deterministic encryption mode where the same plaintext and context always produce the same ciphertext. This is achieved by using the plaintext itself as part of the encryption key derivation, ensuring repeatable output. The question specifically requires deterministic encryption, making convergent encryption the correct choice.

Answer

chacha20-poly1305

Answer

aes128-gcm96

Answer

aes-gcm

Answer

padding

Question 16

A DevOps team needs to encrypt large files (several GB) using Vault's transit engine. What is the recommended approach?

Accepted Answer

Use Vault's datakey endpoint to get a data encryption key, encrypt locally, then wrap with Vault. The transit engine is designed for encrypting small data payloads (typically a few KB), not multi-GB files. The recommended approach is to use the `/transit/datakey/plaintext` endpoint to generate a data encryption key (DEK), encrypt the large file locally with that DEK using a symmetric algorithm like AES-256-GCM, and then wrap (encrypt) the DEK with Vault using the transit engine. This keeps the large file out of Vault while still leveraging Vault for key management and audit logging.

Answer

Use Vault's batch encryption

Answer

Use Vault's seal-wrapping feature

Answer

Encrypt the file directly with Vault's transit encrypt API

Answer

Split the file into chunks and encrypt each chunk via transit

Question 17

A team has set up automatic key rotation on a transit key. After rotation, encrypted data that was encrypted with the previous key version can no longer be decrypted. What is the most likely cause?

Accepted Answer

The key's min_decryption_version is set too high. Option B is correct because the `min_decryption_version` setting on a key in a key management system (such as AWS KMS or GCP Cloud KMS) controls the minimum key version that can be used to decrypt ciphertext. If this value is set too high (e.g., to the current version), older key versions are effectively disabled for decryption, causing any data encrypted with a previous key version to become undecryptable. This is a common misconfiguration when automating key rotation without properly managing version policies.

Answer

The key was deleted

Answer

The key's min_encryption_version is set too high

Answer

The team used the 'rewrap' operation incorrectly

Answer

The key is not exportable

Question 18

An application needs to encrypt credit card numbers. The encryption must be deterministic for indexing purposes but also support key rotation. Which approach should be used?

Accepted Answer

Use convergent encryption with key rotation. Option D is correct because convergent encryption uses a deterministic key derived from the data itself (e.g., SHA-256 hash of the plaintext), which ensures the same credit card number always produces the same ciphertext for indexing. Key rotation is supported by re-encrypting the data encryption key (DEK) with a new key encryption key (KEK), without changing the underlying ciphertext, thus preserving determinism while rotating the wrapping key.

Answer

Use Vault's cubbyhole

Answer

Use Vault's transformations engine

Answer

Use datakey encryption

Answer

Use standard encryption and re-encrypt all data on rotation

Question 19

What is the primary purpose of the Vault transit secrets engine?

Accepted Answer

Encryption and decryption as a service. The Vault transit secrets engine is designed to provide encryption and decryption as a service, allowing applications to encrypt and decrypt data without managing cryptographic keys directly. It offloads the cryptographic operations to Vault, which securely stores and rotates the encryption keys, ensuring that plaintext data never leaves the application unencrypted. This enables centralized key management and policy-based access control for encryption operations.

Answer

Token generation

Answer

Certificate management

Answer

Dynamic database credentials

Answer

Secure storage of secrets

Question 20

A security policy requires that encryption keys used in transit must never leave Vault's memory. However, development teams need to perform encryption offline in CI/CD pipelines. How can this be accomplished?

Accepted Answer

Use Vault's datakey endpoint to get a wrapped key that can be unwrapped offline. Option D is correct because Vault's `datakey` endpoint generates a data encryption key (DEK) that is wrapped by a Vault-managed key. The wrapped DEK can be safely stored and used offline in CI/CD pipelines, while the unwrapped key material never leaves Vault's memory — the DEK is unwrapped only when needed, and the wrapping key remains in Vault. This satisfies the policy requirement that encryption keys used in transit must never leave Vault's memory, as the DEK itself is not a transit key but a data key that can be used offline.

Answer

Use exportable keys and export them

Answer

Use Vault's transit encrypt with context

Answer

Use Vault's ciphertext rewrap

Answer

It is not possible; keys must stay in Vault