Your company's security policies require that all encryption keys must be rotated at least once per year. After using the Transit secrets engine for a year, the Vault admin issues the proper command to rotate the key named ecommerce that was used to encrypt your dat
- What command can be used to easily re-encrypt the original data with the new version of the key?
- vault write -f transit/keys/ecommerce/rotate <old data>
- vault write -f transit/keys/ecommerce/update <old data>
- vault write transit/encrypt/ecommerce v1:v2 <old data>
- vault write transit/rewrap/ecommerce ciphertext=<old data>
Answer(s): D
Explanation:
Comprehensive and Detailed in Depth
The Transit secrets engine in Vault manages encryption keys and supports key rotation. After rotating the ecommerce key, existing ciphertext (encrypted with the old key version) must be re-encrypted (rewrapped) with the new key version without exposing plaintext. Let's evaluate:
A: vault write -f transit/keys/ecommerce/rotate <old data> This command rotates the key, creating a new version, but does not re-encrypt existing data. It's for key management, not data rewrapping. Incorrect.
B: vault write -f transit/keys/ecommerce/update <old data> There's no update endpoint in Transit for re-encrypting data. This is invalid and incorrect.
C: vault write transit/encrypt/ecommerce v1:v2 <old data> The transit/encrypt endpoint encrypts new plaintext, not existing ciphertext. The v1:v2 syntax is invalid. Incorrect.
D: vault write transit/rewrap/ecommerce ciphertext=<old data> The transit/rewrap endpoint takes existing ciphertext, decrypts it with the old key version, and re- encrypts it with the latest key version (post-rotation). This is the correct command. For example, if <old data> is vault:v1:cZNHVx+..., the output might be vault:v2:kChHZ9w4....
Overall Explanation from Vault Docs:
"Vault's Transit secrets engine supports key rotation... The rewrap endpoint allows ciphertext encrypted with an older key version to be re-encrypted with the latest key version without exposing the plaintext." This operation is secure and efficient, using the keyring internally.
Reference:
https://developer.hashicorp.com/vault/tutorials/encryption-as-a-service/eaas-transit- rewrap
Reveal Solution Next Question