Free Preparation Discussions
MENU
HashiCorp Exam HCVA0-003 Topic 4 Question 3 Discussion
Topic #: 4
When unsealing Vault, each Shamir unseal key should be entered:
When unsealing Vault, each Shamir unseal key should be entered by different administrators each connecting from different computers. This is because the Shamir unseal keys are split into shares that are distributed to trusted operators, and no single operator should have access to more than one share. This way, the unseal process requires the cooperation of a quorum of key holders, and enhances the security and availability of Vault. The unseal keys can be entered via multiple mechanisms from multiple client machines, and the process is stateful. The order of the keys does not matter, as long as the threshold number of keys is reached. The unseal keys should not be entered at the command line in one single command, as this would expose them to the history and compromise the security. The unseal keys should not be encrypted with each administrator's PGP key, as this would prevent Vault from decrypting them and reconstructing the master key. Reference: https://developer.hashicorp.com/vault/docs/concepts/seal3, https://developer.hashicorp.com/vault/docs/commands/operator/unseal
Theron
5 days agoHui
11 days agoFannie
16 days agoJame
22 days agoFranklyn
27 days agoBillye
1 months agoAlana
6 months agoDenny
4 months agoBrendan
4 months agoSamira
4 months agoDaron
5 months agoJustine
6 months agoHillary
6 months agoJohnetta
6 months agoCharisse
4 months agoKimberely
5 months agoAzzie
5 months agoEmelda
6 months agoCamellia
5 months agoTheola
5 months agoSimona
6 months agoTijuana
6 months agoWillie
7 months agoTijuana
7 months ago