Hashicorp Certified Vault Associate 002 · Free Practice Question Medium
Question 23
Over a few years, you have a lot of data that has been encrypted by older versions of a Transit encryption key. Due to compliance regulations, you have to re-encrypt the data using the newest version of the encryption key.
What is the easiest way to complete this task without putting the data at risk?
-
A
decrypt the data manually and encrypt it with the latest version
-
B
rotate the encryption key used to encrypt the data
-
C
create a new master key used by Vault
-
D
use the transit rewrap feature
Reveal correct answer
Correct answer: D
Explanation
Luckily, Vault provides an easy way of re-wrapping encrypted data when a key is rotated. Using the rewrap API endpoint, a non-privileged Vault entity can send data encrypted with an older version of the key to have it re-encrypted with the latest version. The application performing the re-wrapping never interacts with the decrypted data. The process of rotating the encryption key and rewrapping records could (and should) be completely automated. Records could be updated slowly over time to lessen database load, or all at once at the time of rotation. The exact implementation will depend heavily on the needs of each particular organization or application.
https://developer.hashicorp.com/vault/tutorials/encryption-as-a-service/eaas-transit-rewrap
A. Decrypting the data manually and then encrypting it with the latest version of the encryption key is a risky approach as it exposes the data in its decrypted state, which violates the requirement of keeping the data secure. This method increases the risk of data exposure and potential security breaches.
B. Rotating the encryption key used to encrypt the data would involve decrypting the data with the old key and then re-encrypting it with the new key. This process introduces unnecessary risk as the data would be temporarily exposed during the key rotation, which goes against the requirement of not putting the data at risk.
C. Creating a new master key used by Vault does not directly address the need to re-encrypt the existing data encrypted with older versions of the encryption key. This approach does not provide a straightforward solution for updating the encryption key for compliance purposes while ensuring the security of the data.
D. Using the transit rewrap feature in Vault allows you to re-encrypt the data without decrypting it first. This feature ensures that the data remains secure throughout the re-encryption process, making it the easiest and safest way to update the encryption key for compliance purposes.
Discussion
Think the marked answer is wrong, or have a better explanation? Share it below — comments appear after review.
