Hashicorp Certified Vault Associate 002 · Free Practice Question Easy
Question 17
Mike's Cereal Shack uses Vault to encrypt customer data to ensure it is always stored securely. They are developing a new application integration to send new customer data to be encrypted using the following API request:
- curl \
- --header "X-Vault-Token: hvs.sf4vj1rFV5PvQSV3M9dcv832brxQFsfbXA" \
- --request POST \
- --data @data.json \
- https://vault.mcshack.com:8200/v1/transit/encrypt/customer-data
What would be contained within the data.json file?
-
A
transit secrets engine configuration file
-
B
cleartext customer data to be encrypted
-
C
ciphertext to be decrypted
-
D
the encryption key to be used for encrypting the data
Reveal correct answer
Correct answer: B
Explanation
When executing any calling the Vault API, data can be sent using an external file as shown above. In this case, the contents of the file would be cleartext customer data that needs to be encrypted by the transit secrets engine.
https://developer.hashicorp.com/vault/api-docs/secret/transit#encrypt-data
A.
The transit secrets engine configuration file would not be contained within the data.json file. The configuration of the transit secrets engine, including key settings and encryption methods, is managed separately within the Vault system and is not part of the data payload for encryption.
B.
The data.json file would contain the cleartext customer data that needs to be encrypted. This data will be sent to the Vault API endpoint for encryption using the transit secrets engine.
C.
The ciphertext to be decrypted would not be contained within the data.json file. The ciphertext is the encrypted form of the customer data generated by Vault after encryption. The data.json file contains the original cleartext data that needs to be encrypted, not the encrypted ciphertext.
D.
The encryption key to be used for encrypting the data would not be contained within the data.json file. The encryption key is typically managed and stored securely within the Vault system, and it is not part of the data that needs to be encrypted.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
