Free HCVA0-003 Questions Attempt

The statement is false. The Vault encryption key is not stored in Vault’s backend storage, but rather in Vault’s memory. The Vault encryption key is the key that is used to encrypt and decrypt the data that is stored in Vault’s backend storage, such as secrets, tokens, policies, etc. The Vault encryption key is derived from the master key, which is generated when Vault is initialized. The master key is split into unseal keys using Shamir’s secret sharing algorithm, and the unseal keys are distributed to trusted operators. To start Vault, a quorum of unseal keys is required to reconstruct the master key and derive the encryption key. The encryption key is then kept in memory and used to protect the data in Vault’s backend storage. The encryption key is never written to disk or exposed via the API. References:  Seal/Unseal | Vault | HashiCorp Developer ,  Key Rotation | Vault | HashiCorp Developer

The statement is true. When an auth method is disabled, all users authenticated via that method lose access. This is because the tokens issued by the auth method are automatically revoked when the auth method is disabled. This prevents the users from performing any operation in Vault using the revoked tokens. To regain access, the users have to authenticate again using a different auth method that is enabled and has the appropriate policies attached. References:  Auth Methods | Vault | HashiCorp Developer ,  auth disable - Command | Vault | HashiCorp Developer

When unsealing Vault, each Shamir unseal key should be entered by different administrators each connecting from different computers. This is because the Shamir unseal keys are split into shares that are distributed to trusted operators, and no single operator should have access to more than one share. This way, the unseal process requires the cooperation of a quorum of key holders, and enhances the security and availability of Vault. The unseal keys can be entered via multiple mechanisms from multiple client machines, and the process is stateful. The order of the keys does not matter, as long as the threshold number of keys is reached. The unseal keys should not be entered at the command line in one single command, as this would expose them to the history and compromise the security.  The unseal keys should not be encrypted with each administrator’s PGP key, as this would prevent Vault from decrypting them and reconstructing the master key.  References: 3 ,

For a very large object, the correct pattern is envelope encryption using a data key. Vault Transit can generate a high-entropy data key, return it to the client, and protect that data key with the named Transit key. The application then encrypts the 2GB blob locally using the plaintext data key and stores the encrypted blob outside Vault. Later, the protected data key can be decrypted or used according to the workflow so the application can decrypt the blob locally. Vault should not permanently store the blob, and it should not temporarily place a 2GB payload into its storage backend. Transit does not store submitted data, and Vault’s HTTP API has a request-size limit, so large-object encryption should be handled through data keys.

================