Skip to content
Cheat sheets

003 · Domain 7: Vault architecture fundamentals · 8% of the exam

Task 7.1: Describe how Vault encrypts data

The barrier, the keyring of AES-256-GCM encryption keys, the root key that protects it, untrusted storage, and rotating the keyring.

Study it

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 1

An attacker copied a full backup of a Vault cluster's integrated storage data directory but has no access to the cloud KMS key that the cluster uses for auto unseal. What can the attacker read from the copy?

  1. AEvery KV secret, because integrated storage writes values to disk in plaintext
  2. BAll of the data, because with auto unseal the root key is kept in the storage backend without any encryption
  3. CSecret values but not tokens, because only token data passes through the barrier
  4. DNo secret values, because they are encrypted by the keyring, whose root key only the KMS key can decrypt
Show the answer and why

  • AEvery KV secret, because integrated storage writes values to disk in plaintext

    Incorrect

    Storage backends are untrusted by design; everything leaving the barrier is encrypted with AES-256-GCM.

  • BAll of the data, because with auto unseal the root key is kept in the storage backend without any encryption

    Incorrect

    The root key is stored alongside the data only in encrypted form; with auto unseal the trusted KMS decrypts it at startup.

  • CSecret values but not tokens, because only token data passes through the barrier

    Incorrect

    All data Vault writes to storage passes through the barrier, secrets included.

  • DNo secret values, because they are encrypted by the keyring, whose root key only the KMS key can decrypt

    Correct

    The barrier encrypts data before it reaches storage; the keyring is protected by the root key, which auto unseal keeps encrypted with the KMS key.

Vault encrypts data with keys in its keyring, the keyring with the root key, and the root key with the unseal key or, under auto unseal, a KMS or HSM key. Storage alone yields only ciphertext.

HashiCorp documentation

Task 7.1Report a problem with this question

Question 2 · choose 1

Security asks for the key that encrypts Vault's storage to be rotated without downtime. What does vault operator rotate do?

  1. AReplaces the unseal key shares and returns new ones
  2. BRe-encrypts every stored entry and seals Vault until it finishes
  3. CAdds a new keyring key for writes; old keys still decrypt
  4. DRotates every transit key in every mount
Show the answer and why

  • AReplaces the unseal key shares and returns new ones

    Incorrect

    Changing the unseal keys is a rekey, not a rotation.

  • BRe-encrypts every stored entry and seals Vault until it finishes

    Incorrect

    Rotation does not rewrite existing entries.

  • CAdds a new keyring key for writes; old keys still decrypt

    Correct

    Rotation adds a new key to the keyring; new writes use it and earlier entries remain decryptable.

  • DRotates every transit key in every mount

    Incorrect

    Transit keys are rotated per key through the transit engine.

rotate changes the data encryption key; rekey changes the root key and its unseal or recovery shares.

HashiCorp documentation

Task 7.1Report a problem with this question

Question 3 · choose 1

An operator has never run vault operator rotate on a busy cluster. Is the barrier encryption key ever rotated anyway?

  1. AYes, automatically before about 2^32 encryptions
  2. BYes, at every restart of the active node
  3. CYes, once a day at midnight UTC by default
  4. DNo, it is rotated only when an operator runs the command
Show the answer and why

  • AYes, automatically before about 2^32 encryptions

    Correct

    By default Vault tracks estimated encryptions and rotates the backend key before reaching 2^32.

  • BYes, at every restart of the active node

    Incorrect

    Restarts do not rotate the encryption key.

  • CYes, once a day at midnight UTC by default

    Incorrect

    The trigger is the encryption count, not a daily schedule.

  • DNo, it is rotated only when an operator runs the command

    Incorrect

    Automatic rotation happens by default as the encryption count grows.

The limit follows NIST's AES-GCM guidance; rotation can also be configured through sys/rotate/config.

HashiCorp documentation

Task 7.1Report a problem with this question

Question 4 · choose 1

An attacker who can write to Vault's storage modifies an encrypted entry. What happens when Vault reads it?

  1. AVault seals itself and requires a rekey
  2. BVault returns the altered value, since storage is trusted
  3. CVault rewraps the entry with a new key and continues
  4. DThe GCM tag check fails and Vault detects the change
Show the answer and why

  • AVault seals itself and requires a rekey

    Incorrect

    A failed tag check does not trigger a rekey.

  • BVault returns the altered value, since storage is trusted

    Incorrect

    Storage is untrusted by design; tampering is detected on read.

  • CVault rewraps the entry with a new key and continues

    Incorrect

    Detection, not silent repair, is what the tag provides.

  • DThe GCM tag check fails and Vault detects the change

    Correct

    Each object uses a random nonce, and the GCM tag is verified during decryption to detect changes.

AES-256-GCM gives both confidentiality and integrity for everything that leaves the barrier.

HashiCorp documentation

Task 7.1Report a problem with this question

Question 5 · choose 1

How is data protected as it moves between the nodes of a Vault cluster, for example for integrated storage or replication?

  1. AIt is not; nodes trust the private network
  2. BWith mutually authenticated TLS between the nodes
  3. CWith the transit engine of the active node
  4. DWith the unseal key shares used as session keys
Show the answer and why

  • AIt is not; nodes trust the private network

    Incorrect

    Vault encrypts and authenticates node-to-node traffic.

  • BWith mutually authenticated TLS between the nodes

    Correct

    Server-to-server traffic within a cluster uses mutually-authenticated TLS.

  • CWith the transit engine of the active node

    Incorrect

    Transit is a secrets engine for clients, not the cluster's transport.

  • DWith the unseal key shares used as session keys

    Incorrect

    Unseal shares only reconstruct the root key.

The barrier protects data at rest; mutual TLS protects it as it moves between nodes.

HashiCorp documentation

Task 7.1Report a problem with this question

Practice domain 7 →Practice all domains →