HashiCorp Certified - Vault Associate Course - Seal and Unseal

The video tutorial explains the concept of Vault's sealed and unsealed states, detailing the process of unsealing Vault to access encrypted data. It covers the importance of key shards, the use of Shamir's Secret Sharing algorithm, and various unsealing methods, including manual sealing for security reasons. The tutorial also demonstrates the unsealing process, emphasizing the need for multiple key holders to ensure data security.

What is the primary limitation of Vault when it is in a sealed state?

• It can decrypt data but not encrypt it.

• It can only encrypt data but not decrypt it.

• It can only perform status checks and unsealing.

• It cannot perform any operations.

What is the purpose of unsealing Vault?

• To encrypt the master key.

• To reconstruct the master key and decrypt the encryption key.

• To delete all stored data.

• To reset the Vault configuration.

Why might an organization choose to manually seal Vault?

• To increase data retrieval speed.

• To protect data after a network compromise.

• To allow more users to access the data.

• To reduce the number of key shards.

Which algorithm is used for key sharding in Vault?

• Diffie-Hellman Key Exchange

• Shamir's Secret Sharing

• AES Encryption

• RSA Encryption

How many key shards are typically created by default in Vault?

• Three

• Ten

• Five

• Seven

What is the minimum number of key shards required to unseal Vault by default?

• Five

• Two

• Three

• Four

What is a recommended practice for storing key shards?

• Distribute them among multiple employees and store offline.

• Encrypt them with a single PGP key.

• Store them online for easy access.

• Keep all shards with a single trusted employee.