A web application uses Vault's transit secrets engine to encrypt data in-transit. If an attacker intercepts the data in transit, which of the following statements are true? (Choose two.)

The Transit secrets engine uses encryption keys managed by Vault. If an attacker intercepts encrypted data, rotating the encryption key *after* the interception event prevents the attacker from decrypting the data with the new key, assuming they did not also compromise Vault itself.

While keys can be rotated and `min_decryption_version` moved forward, this is primarily for managing key compromise for *future* decryption, not directly preventing decryption of *already intercepted* data with the old key by an attacker who has the ciphertext.

Sealing the Vault server immediately prevents any further access to secrets and capabilities, including the Transit secrets engine's encryption keys, thus mitigating further compromise if the attacker is believed to have gained access to Vault itself or to prevent further unauthorized operations.

The Transit secrets engine encrypts data using Vault's managed keys, while TLS encrypts data in transit between the client and Vault. This option incorrectly conflates Transit encryption with TLS and misrepresents the protection provided by the Transit secrets engine.