Free Preparation Discussions
MENU
HashiCorp HCVA0-003 Exam - Topic 4 Question 3 Discussion
Topic #: 4
When unsealing Vault, each Shamir unseal key should be entered:
When unsealing Vault, each Shamir unseal key should be entered by different administrators each connecting from different computers. This is because the Shamir unseal keys are split into shares that are distributed to trusted operators, and no single operator should have access to more than one share. This way, the unseal process requires the cooperation of a quorum of key holders, and enhances the security and availability of Vault. The unseal keys can be entered via multiple mechanisms from multiple client machines, and the process is stateful. The order of the keys does not matter, as long as the threshold number of keys is reached. The unseal keys should not be entered at the command line in one single command, as this would expose them to the history and compromise the security. The unseal keys should not be encrypted with each administrator's PGP key, as this would prevent Vault from decrypting them and reconstructing the master key. Reference: https://developer.hashicorp.com/vault/docs/concepts/seal3, https://developer.hashicorp.com/vault/docs/commands/operator/unseal
Derick
4 months agoVon
4 months agoDesmond
4 months agoLourdes
4 months agoTyisha
5 months agoValentin
5 months agoStefania
5 months agoWayne
5 months agoTheron
6 months agoHui
6 months agoFannie
6 months agoJame
6 months agoFranklyn
6 months agoBillye
6 months agoAlana
11 months agoDenny
9 months agoBrendan
10 months agoSamira
10 months agoDaron
10 months agoJustine
11 months agoHillary
11 months agoJohnetta
11 months agoCharisse
10 months agoKimberely
10 months agoAzzie
10 months agoEmelda
12 months agoCamellia
10 months agoTheola
10 months agoSimona
11 months agoTijuana
12 months agoWillie
12 months agoTijuana
1 year ago