nerdexam
HashiCorp

VAULT-ASSOCIATE-002 · Question #12

How many Shamir's key shares are required to unseal a Vault instance?

The correct answer is D. The threshold number of key shares. To unseal a Vault instance, the specific number of key shares known as the "threshold" is required, which is configured during initialization.

Submitted by krish.m· Apr 18, 2026Understand Vault Concepts

Question

How many Shamir's key shares are required to unseal a Vault instance?

Options

  • AAll key shares
  • BA quorum of key shares
  • COne or more keys
  • DThe threshold number of key shares

How the community answered

(41 responses)
  • A
    2% (1)
  • B
    2% (1)
  • C
    5% (2)
  • D
    90% (37)

Why each option

To unseal a Vault instance, the specific number of key shares known as the "threshold" is required, which is configured during initialization.

AAll key shares

Requiring all key shares would make the system too brittle, as the loss of a single share would prevent unsealing.

BA quorum of key shares

While a quorum generally implies a minimum number, in Shamir's Secret Sharing context for Vault, the specific term is 'threshold' and refers to the minimum number of shares required.

COne or more keys

One or more keys is insufficient; a specific minimum number, the threshold, is necessary to reconstruct the master key.

DThe threshold number of key sharesCorrect

Vault uses Shamir's Secret Sharing to split the master key into multiple shares. The `threshold` number of these shares, configured during Vault initialization, must be provided to reconstruct the master key and unseal the Vault instance.

Concept tested: Vault unsealing, Shamir's Secret Sharing threshold

Source: https://developer.hashicorp.com/vault/docs/concepts/seal#shamirs-secret-sharing

Topics

#Shamir's Secret Sharing#Unsealing#Key shares#Threshold

Community Discussion

No community discussion yet for this question.

Full VAULT-ASSOCIATE-002 Practice