Which of the following is a reason to rekey a Vault cluster? (Choose two.)

When a keyholder leaves or joins the organization, it is a critical security practice to rekey the Vault cluster to ensure that the unseal key shares are updated and properly distributed among the current trusted individuals.

Adding additional Vault nodes to a cluster does not inherently require a rekey operation, as new nodes can join and be unsealed using the existing master key and unseal shares.

The root token is an access token; if it is lost, it can be regenerated, but its loss does not necessitate rekeying the master key or unseal keys of the cluster itself.

Many regulatory and security compliance mandates require the regular rotation of cryptographic keys, including Vault's master key, to mitigate risks associated with long-term key exposure, necessitating a rekey operation.

Upgrading Vault from Community Edition to Enterprise is a software upgrade that does not typically require a rekey of the underlying master key or unseal keys.