Hashicorp Certified Vault Associate 002 · Free Practice Question Easy
Question 20
True or False? After rotating a transit encryption key, all data encrypted with the previous version must be rewrapped or re-encrypted with the new key.
-
A
True
-
B
False
Reveal correct answer
Correct answer: B
Explanation
When you rotate the transit encryption key, future encryptions will use this new key. Old data can still be decrypted due to the use of a key ring.
When you look at ciphertext, it will begin with vault:v#, where v# is the version. For example, the ciphertext shown below was encrypted with v2 of the encryption key.
- Key Value
- --- -----
- ciphertext vault:v2:0VHTTBb2EyyNYHsa3XiXsvXOQSLKulH+NqS4eRZdtc2TwQCxqJ7PUipvqQ==
You can also limit what encryption keys can be used with Vault. If you have rotated the encryption key 7 times, you can configure Vault to limit what encryption keys can be used to decrypt data. For example, you can configure the min_decryption_version parameter to tell Vault to "archive" any key prior to the specified version and not permit a decrypt action using a key older than specified with this parameter. Note that Vault does NOT delete this key, it just archives it. You can update this parameter to an earlier version and older data could then be decrypted.
Good information about using the transit secrets engine, including a paragraph about key versions.
A.
This is incorrect. After rotating a transit encryption key, all data encrypted with the previous version does not need to be rewrapped or re-encrypted with the new key. Vault handles the key rotation process seamlessly, allowing the new key to decrypt data encrypted with the previous key version without manual intervention. This simplifies the key management process and ensures data security without requiring the re-encryption of existing data.
B.
Correct. After rotating a transit encryption key, all data encrypted with the previous version does not need to be rewrapped or re-encrypted with the new key. Vault handles the key rotation process seamlessly, allowing the new key to decrypt data encrypted with the previous key version without manual intervention. This simplifies the key management process and ensures data security without requiring the re-encryption of existing data.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
