HashiCorp Certified - Vault Associate Course - Lab—Transit Secrets Engine

This video tutorial covers the Transit Secrets Engine in Vault, demonstrating how to enable it, create and manage encryption keys, encrypt data, and configure decryption settings. The tutorial also explains the process of rewrapping and decrypting data, highlighting the importance of setting a minimum decryption version to ensure data security.

What is the default path used when enabling the Vault Transit Secrets Engine?

• system

• transit

• cubbyhole

• identity

Which command is used to create a new encryption key in Vault?

• vault read

• vault list

• vault write

• vault secrets enable

What is the purpose of rotating an encryption key in Vault?

• To update the key's description

• To generate a new version of the key

• To delete the key

• To change the key's type

What is the primary purpose of Base64 encoding in the context of Vault?

• To convert data into a format suitable for transmission

• To encrypt data

• To hash data

• To compress data

Which command is used to encrypt data using the Vault Transit Secrets Engine?

• vault secrets enable

• vault list

• vault write transit encrypt

• vault read transit keys

What does the 'rewrap' operation do in Vault?

• Deletes old key versions

• Updates the ciphertext to use a new key version

• Changes the key type

• Decrypts data

How can you verify that rewrapping was successful?

• By checking the key type

• By listing all keys

• By reading the key description

• By comparing the plaintext before and after rewrapping

What happens if you try to decrypt data with a version older than the minimum decryption version?

• The data is decrypted successfully

• An error is returned indicating the version is too old

• The data is re-encrypted

• The key is deleted

What does setting a minimum decryption version in Vault do?

• Deletes older key versions

• Prevents decryption with keys older than the specified version

• Changes the key type

• Enables key export

What is the effect of setting the minimum decryption version to 3?

• Only version 3 and above can decrypt data

• Versions 1 and 2 are deleted

• All versions can decrypt data

• The key is rotated to version 3