Skip to content
Cheat sheets

003 · Domain 6: Encryption as a service · 5% of the exam

Task 6.2: Rotate the encryption key

Rotating a transit key, older versions that still decrypt, rewrapping ciphertext, min_decryption_version, and automatic rotation periods.

Study it

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

After a key review, ciphertext made with version 1 of the transit key orders must stop being decryptable within a week, but no stored order may become unreadable. The key is at version 1 and the database holds 2 million v1 ciphertexts. Which sequence meets both requirements?

  1. ARotate the key, rewrap every stored ciphertext, then set min_decryption_version to 2
  2. BRotate the key; rotation alone makes version 1 ciphertext undecryptable
  3. CRotate the key, set min_decryption_version to 2 at once, and then rewrap the stored ciphertext
  4. DSet auto_rotate_period to 7d, which retires version 1 after a week
Show the answer and why

  • ARotate the key, rewrap every stored ciphertext, then set min_decryption_version to 2

    Correct

    Rewrap moves each ciphertext to the latest version without exposing plaintext, after which version 1 can be retired.

  • BRotate the key; rotation alone makes version 1 ciphertext undecryptable

    Incorrect

    After rotation, older versions still decrypt because the key ring keeps them.

  • CRotate the key, set min_decryption_version to 2 at once, and then rewrap the stored ciphertext

    Incorrect

    Once version 1 is below the minimum, rewrap cannot decrypt the old ciphertext, so those orders become unreadable.

  • DSet auto_rotate_period to 7d, which retires version 1 after a week

    Incorrect

    Rotation never stops older versions from decrypting.

Rotation changes which version encrypts new data; it does not retire old versions.

HashiCorp documentation

Task 6.2Report a problem with this question

Question 2 · choose 1

Which command rotates the transit key orders to a new version?

  1. Avault write -f transit/keys/orders/rotate
  2. Bvault operator rotate transit/keys/orders
  3. Cvault write transit/keys/orders version=2
  4. Dvault secrets tune -rotate transit/
Show the answer and why

  • Avault write -f transit/keys/orders/rotate

    Correct

    Writing to the rotate endpoint adds a new key version to the key ring.

  • Bvault operator rotate transit/keys/orders

    Incorrect

    operator rotate rotates Vault's own barrier key, not transit keys.

  • Cvault write transit/keys/orders version=2

    Incorrect

    Key versions are not set by writing a number.

  • Dvault secrets tune -rotate transit/

    Incorrect

    secrets tune has no rotate flag.

Transit key rotation and barrier key rotation are separate operations with separate commands.

HashiCorp documentation

Task 6.2Report a problem with this question

Question 3 · choose 1

An operator sets auto_rotate_period=30m on a transit key so that it rotates twice an hour. What happens?

  1. AThe key rotates every 30 minutes, as configured
  2. BVault rounds the period up to the 24-hour default
  3. CVault rejects it; the minimum period is one hour
  4. DThe key rotates on every encryption
Show the answer and why

  • AThe key rotates every 30 minutes, as configured

    Incorrect

    Values under one hour are not accepted.

  • BVault rounds the period up to the 24-hour default

    Incorrect

    Vault rejects the value rather than rounding it.

  • CVault rejects it; the minimum period is one hour

    Correct

    auto_rotate_period cannot be shorter than one hour; 0 disables automatic rotation.

  • DThe key rotates on every encryption

    Incorrect

    There is no per-operation rotation setting.

Very frequent rotation also grows the key's archive; time-bounded named keys are an alternative for such needs.

HashiCorp documentation

Task 6.2Report a problem with this question

Question 4 · choose 1

A transit key performs about 40 million encryptions a day and has never been compromised. Why should it still be rotated periodically?

  1. ATransit keys stop decrypting after 30 days unless they are rotated
  2. BEach key version can only encrypt about a million values in total
  3. CRotation shrinks the existing ciphertext
  4. DNIST guidance limits each AES-GCM key version to about 2^32 uses
Show the answer and why

  • ATransit keys stop decrypting after 30 days unless they are rotated

    Incorrect

    Keys do not expire on their own.

  • BEach key version can only encrypt about a million values in total

    Incorrect

    The guidance is about 2^32 encryptions, far more.

  • CRotation shrinks the existing ciphertext

    Incorrect

    Rotation does not change existing ciphertext.

  • DNIST guidance limits each AES-GCM key version to about 2^32 uses

    Correct

    Periodic rotation is recommended even without compromise, before roughly 2^32 encryptions by a key version.

Estimate the encryption rate and pick a rotation frequency that stays well inside the limit; at 40 million a day, quarterly rotation suffices.

HashiCorp documentation

Task 6.2Report a problem with this question

Question 5 · choose 1

A key-management team must rotate the transit key orders, while applications keep only encrypt and decrypt rights. Which grant does the team need?

  1. Aread on transit/keys/orders
  2. Bupdate on transit/keys/orders/rotate only
  3. Csudo and update on transit/keys/orders
  4. Ddelete on transit/keys/orders
Show the answer and why

  • Aread on transit/keys/orders

    Incorrect

    Rotating is a write to the rotate endpoint, which read does not allow.

  • Bupdate on transit/keys/orders/rotate only

    Correct

    Rotation is a POST to the key's rotate endpoint, which needs update there.

  • Csudo and update on transit/keys/orders

    Incorrect

    Rotation is not root-protected; sudo is not the missing piece.

  • Ddelete on transit/keys/orders

    Incorrect

    Deleting a key is not rotating it.

Separate rotation from usage in policies so applications cannot change keys.

HashiCorp documentation

Task 6.2Report a problem with this question

Practice domain 6 →Practice all domains →