Hashicorp Certified Vault Associate 002 · Free Practice Question Medium
Question 16
You have enabled the Transit secrets engine and want to start encrypting data to store in Azure Blob storage. What is the next step that needs to be completed before you can encrypt data? (select two)
-
A
enable the Transits secrets engine API
-
B
export the encryption key and upload it to the application server
-
C
create an encryption key for the application to use
-
D
write a policy that permits the application to use the encryption key
Reveal correct answers
Correct answers: C, D
Explanation
Once the Transit secrets engine is enabled, you can start creating encryption keys using vault write -f transit/keys/<key name>. Once you create your key, the application needs permission to use the key for encrypting data (and decrypting). This is done by permitting the UPDATE capability on the path transit/encrypt/<key name> and transit/decrypt<key name>.
https://developer.hashicorp.com/vault/tutorials/encryption-as-a-service/eaas-transit
A. Enabling the Transit secrets engine API is not a necessary step before encrypting data to store in Azure Blob storage. The focus should be on creating the encryption key and setting up the appropriate permissions for the application to use it.
B. Exporting the encryption key and uploading it to the application server is not required before encrypting data to store in Azure Blob storage. The encryption key should be managed within Vault and accessed by the application through proper policies, rather than exporting it to the application server.
C. Creating an encryption key is essential before encrypting data using the Transit secrets engine. The encryption key will be used by the application to encrypt and decrypt the data stored in Azure Blob storage.
D. Writing a policy that permits the application to use the encryption key is crucial for ensuring that the application has the necessary permissions to access and utilize the encryption key for encrypting data. Without the appropriate policy in place, the application will not be able to perform encryption operations.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
