HashiCorp Certified - Vault Associate Course - Using the Transit Secrets Engine

The video tutorial covers the Transit Secrets Engine in Vault, focusing on enabling the engine, creating encryption keys, encrypting and decrypting data, rotating encryption keys, and rewrapping ciphertext. It provides detailed command-line instructions and explains the importance of key management and data security.

What is the first step in working with the Transit Secrets Engine?

• Create an encryption key

• Enable the Transit Secrets Engine

• Decrypt existing data

• Rotate the encryption key

Which command is used to create an encryption key in the Transit Secrets Engine?

• vault encrypt key

• vault write -f transit keys

• vault enable key

• vault create key

What must be done to plaintext before encrypting it with the Transit Secrets Engine?

• Base64 encode it

• Encrypt it with another key

• Compress it

• Hash it

Which part of the command specifies the action to be performed in the Transit Secrets Engine?

• The plaintext

• The mount path

• The encryption key name

• The desired action

What is the purpose of the 'decrypt' command in the Transit Secrets Engine?

• To convert ciphertext back to plaintext

• To create a new encryption key

• To enable the Transit Secrets Engine

• To rotate the encryption key

Why is it important to know the key version used for encryption?

• To determine the encryption algorithm

• To ensure compatibility with decryption

• To verify the data source

• To check the data integrity

What does setting a minimum key version in the Transit Secrets Engine do?

• Deletes old keys

• Prevents decryption with older key versions

• Encrypts data with the latest key

• Automatically rotates keys

How can you rotate an encryption key in the Transit Secrets Engine?

• vault update key

• vault write -f transit keys rotate

• vault change key

• vault rotate key

What is the benefit of rewrapping ciphertext in the Transit Secrets Engine?

• It compresses the data

• It changes the encryption algorithm

• It deletes the old ciphertext

• It updates the encryption to a newer key version without exposing plaintext

What happens to the plaintext during the rewrap process?

• It is exposed temporarily

• It remains encrypted

• It is deleted

• It is converted to a different format