Skip to content
Cheat sheets

003 · Domain 7: Vault architecture fundamentals · 8% of the exam

Task 7.2: Explain how to seal and unseal Vault

Starting sealed, unsealing with key shares or auto unseal, recovery keys, sealing in an emergency, and what each node in a cluster needs.

Study it

  • Sealing and unsealing: Shamir shares, auto unseal and recovery keys

    Lesson coming

Sample questions

Try each one before opening the answer. Every option is explained, with the HashiCorp documentation page that proves it.

Question 1 · choose 2

During an incident an operator seals an auto-unsealed Vault node with vault operator seal. Which two statements about that node are true? (Choose TWO.)

  1. AIt stays sealed until it is restarted or unsealed through the unseal API with recovery key shares
  2. BThe root key has been removed from its memory
  3. CIt unseals itself again within a minute through the KMS
  4. DIt keeps answering reads from secrets it already had in memory
  5. ESealing it needed a quorum of recovery key holders
Show the answer and why

  • AIt stays sealed until it is restarted or unsealed through the unseal API with recovery key shares

    Correct

    After an API seal, an auto-unseal node remains sealed until restart or an unseal call, which takes recovery key fragments.

  • BThe root key has been removed from its memory

    Correct

    Sealing deletes the root key from memory, so a new unseal is needed to restore it.

  • CIt unseals itself again within a minute through the KMS

    Incorrect

    Auto unseal acts at startup; a node sealed through the API stays sealed.

  • DIt keeps answering reads from secrets it already had in memory

    Incorrect

    A sealed node can only report status and be unsealed.

  • ESealing it needed a quorum of recovery key holders

    Incorrect

    Sealing needs only a single operator with root privileges.

Sealing is the emergency brake: one privileged operator can do it, and the node then holds no root key until it is unsealed again.

HashiCorp documentation

Task 7.2Report a problem with this question

Question 2 · choose 1

A three-node integrated storage cluster with a Shamir seal (threshold 3) restarts after maintenance. The operators enter three key shares on node 1, which unseals. Nodes 2 and 3 still report Sealed true. What is needed?

  1. AEnter three key shares on node 2, then three key shares on node 3
  2. BNothing; the standbys get the root key from node 1 over Raft
  3. CEnter one more of the key shares on each standby, because node 1 already reached the threshold
  4. DRun vault operator unseal -migrate on node 1 to unseal the other nodes from it
Show the answer and why

  • AEnter three key shares on node 2, then three key shares on node 3

    Correct

    With the Shamir seal, each node must be unsealed with the threshold of shares; a partly unsealed state is not shared.

  • BNothing; the standbys get the root key from node 1 over Raft

    Incorrect

    Vault does not distribute an unsealed root key to other nodes under the Shamir seal.

  • CEnter one more of the key shares on each standby, because node 1 already reached the threshold

    Incorrect

    Every node needs the full threshold of shares.

  • DRun vault operator unseal -migrate on node 1 to unseal the other nodes from it

    Incorrect

    Nothing run on node 1 unseals the other nodes.

Shamir unsealing is per node. Auto unseal removes this manual step because each node asks the trusted service to decrypt the root key at start.

HashiCorp documentation

Task 7.2Report a problem with this question

Question 3 · choose 1

Vault servers on EC2 use the awskms seal with a dedicated KMS key, and the instances' IAM role grants the permissions. Which KMS permissions on that key does HashiCorp list for the seal?

  1. Akms:Encrypt, kms:Decrypt and kms:DescribeKey on the key
  2. Bkms:Decrypt only, since Vault never encrypts with the key
  3. Ckms:CreateKey and kms:ScheduleKeyDeletion, to manage the key
  4. Dkms:GenerateDataKey and kms:ReEncrypt, for each restart
Show the answer and why

  • Akms:Encrypt, kms:Decrypt and kms:DescribeKey on the key

    Correct

    The awskms seal documentation lists exactly these, granted through IAM, the key policy or KMS grants.

  • Bkms:Decrypt only, since Vault never encrypts with the key

    Incorrect

    The documented list includes kms:Encrypt and kms:DescribeKey as well.

  • Ckms:CreateKey and kms:ScheduleKeyDeletion, to manage the key

    Incorrect

    Vault uses an existing key and needs no rights to create keys or schedule their deletion.

  • Dkms:GenerateDataKey and kms:ReEncrypt, for each restart

    Incorrect

    These are not on the documented list for the awskms seal.

The awskms seal can also take its key ID and credentials from environment variables, and the permissions can be granted through IAM, the key policy or KMS grants.

HashiCorp documentation

Task 7.2Report a problem with this question

Question 4 · choose 1

During unsealing, an operator wants to see whether the node is still sealed and how many key shares have been entered. Which command shows that?

  1. Avault operator members
  2. Bvault token lookup
  3. Cvault status
  4. Dvault operator raft list-peers
Show the answer and why

  • Avault operator members

    Incorrect

    members lists the nodes of an HA cluster.

  • Bvault token lookup

    Incorrect

    A sealed node cannot look up tokens.

  • Cvault status

    Correct

    status reports the seal state and, while sealed, the unseal progress and threshold.

  • Dvault operator raft list-peers

    Incorrect

    That lists Raft peers, not unseal progress.

Before unsealing, status and unseal are the only operations a node can do.

HashiCorp documentation

Task 7.2Report a problem with this question

Question 5 · choose 1

A team wants nodes to unseal themselves at start with an AWS KMS key. Where is that configured?

  1. AWith vault operator unseal -kms on each start
  2. BA seal "awskms" stanza in each server's config
  3. CIn the AWS secrets engine's root configuration
  4. DIn a KV secret that stores the unseal keys
Show the answer and why

  • AWith vault operator unseal -kms on each start

    Incorrect

    There is no such flag; auto unseal needs no manual command.

  • BA seal "awskms" stanza in each server's config

    Correct

    Auto unseal is configured in the seal stanza; at startup Vault asks the service to decrypt the root key.

  • CIn the AWS secrets engine's root configuration

    Incorrect

    The AWS secrets engine issues credentials; it does not unseal Vault.

  • DIn a KV secret that stores the unseal keys

    Incorrect

    Unseal keys in KV would be unreadable while Vault is sealed.

Auto unseal moves custody of the unseal key to a trusted device or service.

HashiCorp documentation

Task 7.2Report a problem with this question

Question 6 · choose 1

A Shamir-sealed node was unsealed this morning, and nobody has run vault operator seal since. Which event seals it again?

  1. AThe initial root token being revoked by an administrator
  2. BA client failing to log in ten times in a row
  3. CIts only enabled audit device becoming unable to write
  4. DAn unrecoverable error in Vault's storage layer
Show the answer and why

  • AThe initial root token being revoked by an administrator

    Incorrect

    Token revocation has no effect on the seal.

  • BA client failing to log in ten times in a row

    Incorrect

    Failed logins never seal Vault.

  • CIts only enabled audit device becoming unable to write

    Incorrect

    Vault stops answering requests it cannot audit, but that does not seal the node.

  • DAn unrecoverable error in Vault's storage layer

    Correct

    A node stays unsealed until it is resealed through the API, restarted, or its storage layer hits an unrecoverable error.

Once unsealed, a node stays unsealed until it is resealed through the API, restarted, or its storage layer fails unrecoverably.

HashiCorp documentation

Task 7.2Report a problem with this question

Practice domain 7 →Practice all domains →