Hashicorp Certified Vault Associate 002 · Free Practice Question Medium
Question 12
Which of the following best describes response wrapping?
-
A
Vault takes the response and inserts it into the cubbyhole of a single-use token. The user can retrieve the data by unwrapping the token.
-
B
rather than provide a direct response to the user, Vault returns a token and an accessor. The accessor must be provided to Vault in order to obtain access to the data, assuming the user has the appropriate permissions.
-
C
the response is Base64 encoded, and the user must decode the response in order to retrieve the cleartext data. This helps ensure the protection of the data in the event of a man in the middle attack.
-
D
Vault responds to the client with an encrypted version of the response. The client must decrypt the response using the transit secrets engine. Once decrypted, the response must be Base64 decoded to reveal the cleartext data.
Reveal correct answer
Correct answer: A
Explanation
When requested, Vault can take the response it would have sent to an HTTP client and instead insert it into the cubbyhole of a single-use token, returning that single-use token instead. Logically speaking, the response is wrapped by the token, and retrieving it requires an unwrap operation against this token.
https://developer.hashicorp.com/vault/docs/concepts/response-wrapping#overview
A. Response wrapping in Vault involves taking the response and securely storing it in a cubbyhole of a single-use token. This ensures that the data is protected and can only be accessed by unwrapping the token, providing an extra layer of security for sensitive information.
B. This choice describes the concept of using tokens and accessors to control access to data in Vault, which is different from response wrapping. Response wrapping specifically involves storing the response in a token for secure retrieval, rather than providing a token and an accessor for accessing the data.
C. Base64 encoding and decoding are not directly related to response wrapping in Vault. Response wrapping focuses on securely storing the response in a token for retrieval, rather than encoding and decoding the response for protection against potential attacks.
D. This choice describes the process of encryption and decryption using the transit secrets engine, which is not directly related to response wrapping in Vault. Response wrapping does not involve encrypting the response and decrypting it using transit secrets engine; instead, it focuses on securely storing the response in a token for retrieval.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
