Discuss HashiCorp Vault-Associate Exam Topic 4 Question 10

A web application uses Vault's transit secrets engine to encrypt data in-transit. If an attacker intercepts the data in transit which of the following statements are true? Choose two correct answers.

AYou can rotate the encryption key so that the attacker won't be able to decrypt the data

BThe keys can be rotated and min_decryption_version moved forward to ensure this data cannot be decrypted

CThe Vault administrator would need to seal the Vault server immediately

DEven if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit)

Suggested Answer: B

Running the second command in the GUI CLI will fail. The second command is vault kv put secret/creds passcode=my-long-passcode. This command attempts to write a secret named creds with the value passcode=my-long-passcode to the secret path, which is the default path for the kv secrets engine. However, the kv secrets engine is not enabled at the secret path, as shown by the first command vault secrets list, which lists the enabled secrets engines and their paths. The only enabled secrets engine is the transit secrets engine at the transit path. Therefore, the second command will fail with an error message saying that no secrets engine is mounted at the path secret/. To make the second command succeed, the kv secrets engine must be enabled at the secret path or another path, using the vault secrets enable command. For example, vault secrets enable -path=secret kv would enable the kv secrets engine at the secret path.Reference:kv - Command | Vault | HashiCorp Developer,vault secrets enable - Command | Vault | HashiCorp Developer

Get Premium Vault-Associate Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

31 comments · newest first

Benedict 11 months ago

I disagree with D, they might still find a way to decrypt it.

Dannette 11 months ago

Sealing the Vault server is a must in any breach situation.

Jutta 11 months ago

Wait, how can they decrypt it if it's just encrypted bits?

Dorsey 12 months ago

I think B is also correct!

Oliva 12 months ago

A and D seem right to me.

Dion 1 year ago

I feel like option C is a bit of a stretch. Sealing the Vault server seems drastic for just an interception.

Kaycee 1 year ago

I'm a bit confused about option D. If the data is encrypted in transit, does that mean the attacker can't do anything with it?

Pearly 1 year ago

I think option B sounds right because it mentions moving the min_decryption_version, which we discussed in class.

Beata 1 year ago

I remember something about key rotation being important, but I'm not sure if it applies here.

Glendora 1 year ago

I've got this! The correct answers are B and D. By rotating the keys and moving the min_decryption_version, the attacker won't be able to decrypt the intercepted data. And even if they could access the raw data, it would still be encrypted.

Tequila 1 year ago

Okay, let's think this through. The attacker has intercepted the encrypted data, so we need to make sure they can't decrypt it. Rotating the keys and sealing the Vault server seem like logical steps to take.

Freeman 1 year ago

This question seems straightforward. I think the key is understanding how Vault's transit secrets engine works and the options available for protecting the encrypted data.

Fallon 1 year ago

Hmm, I'm a bit unsure about this one. Rotating the encryption key and moving the min_decryption_version forward sounds like a good strategy, but I'm not sure if that's the complete answer.

Malcom 1 year ago

I've got a good feeling about this one. The router should send a link-state update to the neighbor to provide the correct, up-to-date LSA information.

Kenneth 1 year ago

Okay, let me break this down. The key things I need to look for are an object that can calculate an average and also group the data by country. I think a few of these options could work, but I'll have to evaluate them closely.

Sue 1 year ago

Gotta love these Vault questions! They really make you think about the security implications of your infrastructure. I'm just glad I don't have to worry about sealing the Vault server every time someone sniffs the network.

Irma 1 year ago

↳ replying to Sue

D) Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit)

Allene 1 year ago

↳ replying to Sue

A) You can rotate the encryption key so that the attacker won't be able to decrypt the data

Bette 1 year ago

Exactly, even if the attacker got their hands on the raw data, all they'd have is a bunch of encrypted bits. It's like trying to read a book written in a language you don't understand.

Galen 1 year ago

Haha, sealing the Vault server? That's a bit of an overkill, don't you think? I mean, the data is already encrypted in transit, so the attacker wouldn't be able to read it anyway.

Youlanda 1 year ago

↳ replying to Galen

D) Even if the attacker was able to access the raw data, they would only have encrypted bits (TLS in transit)

Antonio 1 year ago

↳ replying to Galen

A) You can rotate the encryption key so that the attacker won't be able to decrypt the data

Ora 1 year ago

Yup, those are the right answers. Rotating the encryption key and moving the min_decryption_version forward is the way to go if an attacker intercepts the data in transit.

Irma 2 years ago

But wouldn't sealing the Vault server also be a good option to prevent further access by the attacker?

Chara 2 years ago

I agree with you, Lea. Rotating the encryption key and having only encrypted bits would protect the data.

Cristen 2 years ago

Wow, this question is really testing our knowledge of Vault's transit secrets engine! I think options A and B are the correct answers here.

Malcom 1 year ago

↳ replying to Cristen

Even if the attacker intercepts the data, they would only have encrypted bits to work with.

Eleonora 1 year ago

↳ replying to Cristen

Sealing the Vault server may be necessary in extreme cases, but rotating the keys is crucial.

Hui 1 year ago

↳ replying to Cristen

It's important to rotate the encryption key and move min_decryption_version forward to protect the data.

Sherita 1 year ago

↳ replying to Cristen

I agree, options A and B make sense in this scenario.

Lea 2 years ago

I think the correct answers are A and D.

HashiCorp Vault-Associate Exam - Topic 4 Question 10 Discussion