VAULT-ASSOCIATE-002 · Question #100
To encrypt your secret with the transit secrets engine, you must send the Base32-encoded plaintext to Vault.
The correct answer is B. False. It is false that the Vault transit secrets engine requires Base32-encoded plaintext for encryption; it accepts raw plaintext and typically returns ciphertext in Base64 encoding.
Question
Options
- ATrue
- BFalse
How the community answered
(28 responses)- A7% (2)
- B93% (26)
Why each option
It is false that the Vault transit secrets engine requires Base32-encoded plaintext for encryption; it accepts raw plaintext and typically returns ciphertext in Base64 encoding.
True. This is incorrect because the transit secrets engine's `/encrypt` endpoint specifically takes a `plaintext` field which should contain the raw, unencoded data to be encrypted, not pre-encoded Base32.
False. The Vault transit secrets engine expects raw plaintext data directly as input to its `/encrypt` endpoint, typically provided in a `plaintext` field. While the output of the encryption operation is commonly Base64-encoded ciphertext, the input plaintext itself does not need to be pre-encoded by the user in Base32 or any other format.
Concept tested: Vault Transit secrets engine plaintext encryption input
Source: https://developer.hashicorp.com/vault/api-docs/secrets/transit#encrypt-data
Topics
Community Discussion
No community discussion yet for this question.