Vault Associate Encryption as a Service Quiz

1. Which of the following is a valid use case for Vault's encryption as a service?

Encrypting sensitive data at rest in application databases

Replacing network firewalls

Eliminating the need for SSL/TLS

Removing the requirement for access controls

2. How does Vault's encryption as a service ensure compliance with encryption standards?

By using only FIPS 140-2 validated cryptographic modules

By supporting configurable algorithms and audit logging

By storing all encryption keys in plaintext

By eliminating the need for key management

3. What is the 'datakey' operation in Vault's transit engine primarily used for?

To generate unique encryption keys for encrypting large datasets

To delete encryption keys

To export the master encryption key

To verify key integrity

4. In a multi-datacenter Vault setup, how are encryption keys managed across datacenters?

Each datacenter maintains independent keys

Keys are replicated automatically via Vault replication

Keys must be manually copied between datacenters

Only one datacenter can use encryption as a service

5. What does the 'plaintext' output option do when decrypting with Vault's transit engine?

Returns base64-encoded decrypted data

Logs the plaintext to the audit log

Stores plaintext in Vault storage

Returns plaintext directly without encoding

6. Which Vault policy permission is required to encrypt data in the transit engine?

Read

Write

Update

Both b and c

7. What is the primary benefit of using Vault's encryption as a service instead of application-level encryption?

It is faster than application-level encryption

It centralizes key management and audit logging

It eliminates the need for secure communication

It requires no authentication

8. How should encryption keys be rotated in a Vault transit engine setup?

Manually by deleting the old key

Using the 'rotate' endpoint to create new key versions

By exporting keys and re-importing them

Rotation is not supported in transit engine

9. In Vault's transit engine, what is the 'nonce' parameter used for?

To identify the encryption algorithm

To provide randomness for authenticated encryption modes like AES-GCM

To specify the key version

To set user permissions

10. What does the 'convergent_encryption' option in transit engine enable?

Faster encryption operations

The same plaintext to always encrypt to the same ciphertext

Automatic key rotation

Decryption without the original key

11. What is the primary purpose of HashiCorp Vault's encryption as a service (EaaS) feature?

To centralize encryption key management and provide encryption/decryption services

To replace traditional SSL/TLS protocols entirely

To eliminate the need for database encryption

To provide only symmetric encryption algorithms

12. What is the 'rewrap' operation in Vault's transit engine used for?

To decrypt and re-encrypt data with a new key version

To permanently delete encrypted data

To change the encryption algorithm

To export the encryption key

13. How does Vault's transit engine handle plaintext exposure?

It stores plaintext temporarily in memory

Plaintext is never stored; only encrypted data is handled

Plaintext is logged for audit purposes

Plaintext is stored in the Vault database

14. What does BYOK stand for in the context of Vault?

Bring Your Own Key

Build Your Operational Knowledge

Backup Your Organization's Keys

Basic Yield Over Keyshare

15. In Vault's transit engine, what happens when you enable key rotation?

All existing encrypted data is automatically decrypted

A new encryption key version is created for future encryption operations

All previous encryption keys are deleted

Encryption operations are suspended

16. What is the purpose of the 'context' parameter in transit engine operations?

To specify the encryption algorithm

To provide additional authenticated data for key derivation

To set the encryption key rotation schedule

To define user access permissions

17. Which encryption algorithms does Vault's transit engine support by default?

Only AES-128

AES-GCM and ChaCha20-Poly1305

Only RSA encryption

Only DES encryption

18. What is a key feature of Vault's key derivation in the transit engine?

It allows encryption of plaintext without storing keys

It eliminates the need for authentication

It derives unique encryption keys from a single master key per context

It requires manual key rotation every hour

19. In Vault's transit engine, what does the encrypt operation return?

Plaintext data

Base64-encoded ciphertext

The encryption key itself

A temporary access token

20. Which Vault secret engine is specifically designed for encryption as a service?

Transit secret engine

Database secret engine

Kubernetes secret engine

SSH secret engine