Skip to content
Cheat sheets

003 · Domain 5: Secrets engines · 20% of the exam

Task 5.5: Describe the use of response wrapping

Returning a single-use wrapping token instead of the secret, its TTL, unwrapping, lookup to check where it came from, and what a failed unwrap tells you.

Study it

  • Response wrapping: single-use wrapping tokens and unwrapping

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

A deployment tool delivers a response-wrapped SecretID to a new server with a 10-minute wrap TTL. Two minutes later the server's lookup of the wrapping token reports that the token is invalid. What should happen next?

  1. ARequest a new wrapped SecretID with a 30-minute wrap TTL and carry on with the server's deployment
  2. BRaise a security alert and check the audit logs to see whether the token was already unwrapped
  3. CCall sys/wrapping/rewrap on the token to obtain a fresh wrapping token
  4. DUnwrap it with the deployment tool's own token, which created the wrapping
Show the answer and why

  • ARequest a new wrapped SecretID with a 30-minute wrap TTL and carry on with the server's deployment

    Incorrect

    The TTL had not expired, so a longer TTL does not explain the failure, and continuing ignores possible interception.

  • BRaise a security alert and check the audit logs to see whether the token was already unwrapped

    Correct

    A token that cannot be unwrapped, or fails lookup before its TTL, may have been intercepted and should trigger an immediate investigation.

  • CCall sys/wrapping/rewrap on the token to obtain a fresh wrapping token

    Incorrect

    Rewrap works only on a valid wrapping token, and it would not reveal who used this one.

  • DUnwrap it with the deployment tool's own token, which created the wrapping

    Incorrect

    A wrapping token is single use; once it is used or revoked nobody can unwrap it, whichever token makes the call.

Response wrapping gives malfeasance detection: only one party can ever unwrap a token. An unexpected invalid token is a security event to investigate.

HashiCorp documentation

Task 5.5Report a problem with this question

Question 2 · choose 2

A service expects a wrapped TLS private key issued from pki/issue/web. Before unwrapping the token it received, which two checks does HashiCorp's validation guidance call for? (Choose TWO.)

  1. ARenew the wrapping token to keep it from expiring during the unwrap
  2. BLook up the wrapping token to confirm it is still valid and has not been used
  3. CRewrap the token first and unwrap the fresh token instead
  4. DRead pki/issue/web directly to compare the result with the wrapped key
  5. EConfirm that the token's creation path is pki/issue/web as expected
Show the answer and why

  • ARenew the wrapping token to keep it from expiring during the unwrap

    Incorrect

    Validation does not involve renewing; a wrapping token's short TTL is what limits exposure.

  • BLook up the wrapping token to confirm it is still valid and has not been used

    Correct

    A lookup shows at once whether the token was already unwrapped, expired or revoked.

  • CRewrap the token first and unwrap the fresh token instead

    Incorrect

    Rewrapping moves data to a new token but does not validate where the original came from.

  • DRead pki/issue/web directly to compare the result with the wrapped key

    Incorrect

    Each read of that path issues a new certificate and key, so nothing can be compared.

  • EConfirm that the token's creation path is pki/issue/web as expected

    Correct

    A different creation path, such as cubbyhole or sys/wrapping/wrap, suggests the data was read and rewrapped.

Validate by lookup, check the creation path (exactly for KV paths), and only then unwrap.

HashiCorp documentation

Task 5.5Report a problem with this question

Question 3 · choose 1

When a client requests response wrapping, where does Vault keep the original response until it is unwrapped?

  1. AIn the requesting token's own cubbyhole
  2. BIn a KV path that only the recipient can read
  3. CNowhere; the wrapping token encrypts the response inside itself
  4. DIn the cubbyhole of a new single-use wrapping token
Show the answer and why

  • AIn the requesting token's own cubbyhole

    Incorrect

    A new token is generated; the requester's cubbyhole is not used.

  • BIn a KV path that only the recipient can read

    Incorrect

    Wrapped responses are not stored in KV.

  • CNowhere; the wrapping token encrypts the response inside itself

    Incorrect

    The token is a reference; the data stays in Vault.

  • DIn the cubbyhole of a new single-use wrapping token

    Correct

    Vault serializes the response and stores it in the single-use token's cubbyhole.

The wrapping token is only a pointer: whoever presents it first gets the response, once.

HashiCorp documentation

Task 5.5Report a problem with this question

Question 4 · choose 1

A service receives a wrapping token from an orchestrator. Which CLI command returns the wrapped secret?

  1. Avault read cubbyhole/response
  2. Bvault unwrap <wrapping_token>
  3. Cvault token lookup <wrapping_token>
  4. Dvault login <wrapping_token>
Show the answer and why

  • Avault read cubbyhole/response

    Incorrect

    Reading cubbyhole directly is not how wrapped data is retrieved.

  • Bvault unwrap <wrapping_token>

    Correct

    unwrap returns the response stored in the wrapping token.

  • Cvault token lookup <wrapping_token>

    Incorrect

    lookup shows token properties, not the wrapped data.

  • Dvault login <wrapping_token>

    Incorrect

    Logging in with it would not return the wrapped response.

Unwrapping consumes the token; a second unwrap fails.

HashiCorp documentation

Task 5.5Report a problem with this question

Question 5 · choose 1

A script calls the HTTP API to read secret/data/app and wants the response returned wrapped for 2 minutes. How does it ask for that?

  1. ASend the header X-Vault-Wrap-TTL: 2m
  2. BAdd ?wrap=2m to the request URL as a query parameter
  3. CWrite the response to sys/wrapping/wrap afterwards
  4. DSet wrap_ttl=2m in the request body
Show the answer and why

  • ASend the header X-Vault-Wrap-TTL: 2m

    Correct

    Wrapping is triggered per request by the desired TTL in the X-Vault-Wrap-TTL header.

  • BAdd ?wrap=2m to the request URL as a query parameter

    Incorrect

    Wrapping is requested through a header, not a query string.

  • CWrite the response to sys/wrapping/wrap afterwards

    Incorrect

    That wraps data the client already holds, after it was exposed.

  • DSet wrap_ttl=2m in the request body

    Incorrect

    A body field is not how wrapping is requested.

The header applies to that one request; the response then carries only a wrapping token, and the secret stays in Vault until it is unwrapped.

HashiCorp documentation

Task 5.5Report a problem with this question

Question 6 · choose 1

An operator holds a one-time password that is not stored in Vault and wants to hand it to a colleague as a single-use wrapping token. Which endpoint does that?

  1. Asys/wrapping/rewrap
  2. Bsys/wrapping/lookup
  3. Csys/wrapping/wrap
  4. Dcubbyhole/<colleague>
Show the answer and why

  • Asys/wrapping/rewrap

    Incorrect

    rewrap moves existing wrapped data to a new token.

  • Bsys/wrapping/lookup

    Incorrect

    lookup returns a wrapping token's properties.

  • Csys/wrapping/wrap

    Correct

    wrap echoes back the data sent to it inside a response-wrapping token.

  • Dcubbyhole/<colleague>

    Incorrect

    That is not an endpoint that creates wrapping tokens.

Any data can be wrapped; wrapping tokens are just as useful for values that never lived in Vault.

HashiCorp documentation

Task 5.5Report a problem with this question

Practice domain 5 →Practice all domains →