HashiCorp Security Automation Certification HCVA0-003 Question # 37 Topic 4 Discussion

Comprehensive and Detailed in Depth Explanation:

The Transit secrets engine in Vault manages encryption keys and supports key rotation. After rotating the ecommerce key, existing ciphertext (encrypted with the old key version) must be re-encrypted (rewrapped) with the new key version without exposing plaintext. Let’s evaluate:

A: vault write -f transit/keys/ecommerce/rotate <old data>This command rotates the key, creating a new version, but does not re-encrypt existing data. It’s for key management, not data rewrapping. Incorrect.

B: vault write -f transit/keys/ecommerce/update <old data>There’s no update endpoint in Transit for re-encrypting data. This is invalid and incorrect.

C: vault write transit/encrypt/ecommerce v1:v2 <old data>The transit/encrypt endpoint encrypts new plaintext, not existing ciphertext. The v1:v2 syntax is invalid. Incorrect.

D: vault write transit/rewrap/ecommerce ciphertext=<old data>The transit/rewrap endpoint takes existing ciphertext, decrypts it with the old key version, and re-encrypts it with the latest key version (post-rotation). This is the correct command. For example, if is vault:v1:cZNHVx+..., the output might be vault:v2:kChHZ9w4....

Overall Explanation from Vault Docs:

“Vault’s Transit secrets engine supports key rotation… The rewrap endpoint allows ciphertext encrypted with an older key version to be re-encrypted with the latest key version without exposing the plaintext.” This operation is secure and efficient, using the keyring internally.