You have TBs of data encrypted by Vault stored in a database and are worried about Vault becoming unavailable and not being able to decrypt the dat
Answer(s): A
Comprehensive and Detailed In-DepthVault allows key export under specific conditions:A . Yes, if Exportable: "When creating the key, the exportable flag must be set as true. By default, it is false." If set, "this enables the keys to be exportable," allowing retrieval for external storage. "Once set, this cannot be disabled."Incorrect Option:B . No: Incorrect if the key is exportable. "You cannot export the encryption key from Vault if it was not configured to be exportable."This feature, while not best practice, supports disaster recovery scenarios.
https://developer.hashicorp.com/vault/api-docs/secret/transit#exportable
True or False? To encrypt existing encrypted data with the latest version of the encryption key, you need to first decrypt it and then request Vault to re-encrypt it with the latest version of the encryption key.
Answer(s): B
Comprehensive and Detailed In-DepthThis statement is false due to Vault's rewrap feature:B . False: "You can use the rewrap feature of the transit secrets engine to rewrap the data with the latest version of the key. This process does not reveal the plaintext data." Rewrapping updates the encryption key version without decryption.Incorrect Option:A . True: Incorrect; rewrapping avoids the decrypt-re-encrypt cycle.This enhances security and efficiency in key rotation.
https://developer.hashicorp.com/vault/docs/secrets/transit
Elijah manages a legacy application that requires strict control over when its service account credentials change. Which type of credential should be used for this legacy application?
Comprehensive and Detailed In-DepthFor strict control over credential changes:A . static: "Static credentials should be used here so they can be controlled outside of Vault." They remain constant until manually updated, suiting legacy needs. "Stored within Vault using the KV secrets engine."Incorrect Option:B . dynamic: "Designed to change automatically," which conflicts with strict control requirements. Static credentials offer predictability for legacy systems.
https://developer.hashicorp.com/vault/tutorials/secrets-management/static-secrets
What occurs when a Vault cluster cannot maintain a quorum while using the Integrated Storage backend?
Comprehensive and Detailed In-DepthIntegrated Storage (Raft) requires a quorum:B . Unavailable: "If a cluster cannot achieve quorum, the cluster becomes unavailable and cannot commit new logs." Quorum is "a majority of members from a peer set," e.g., 3 of 5 nodes.Incorrect Options:A . Read-Only: "Does not continue to operate in read-only mode." C. Auto-Promotion: "Does not automatically promote a standby node." D. Local Storage: "Does not temporarily switch to local storage." Quorum loss halts operations to ensure consistency.
https://developer.hashicorp.com/vault/docs/v1.16.x/internals/integrated-storage
Assuming default configurations, which of the following operations require a threshold of key shares to perform? (Select three)
Answer(s): B,C,D
Comprehensive and Detailed In-DepthCertain operations require unseal keys:B . Unsealing: "Unsealing the Vault requires a threshold of unseal keys." C. Root Token: "Generating a new root token requires a threshold of unseal keys." D. Recovery Keys: "Changing the unseal/recovery keys requires the current threshold." Incorrect Option:A . Key Rotation: "An online operation and does not cause downtime," no shares needed.
https://developer.hashicorp.com/vault/docs/commands/operator/rekey
Post your Comments and Discuss HashiCorp HCVA0-003 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the HCVA0-003 content, but please register or login to continue.