nerdexam
HashiCorp

VAULT-ASSOCIATE-002 · Question #55

One of the benefits of using the Vault transit secrets engine is its ability to easily rotate encryption keys. Which of these is true regarding key rotation?

The correct answer is D. Encryption keys can be rotated manually by a user, or by an automated process which invokes the. Vault's Transit secrets engine allows for encryption key rotation, which can be initiated manually by a user or programmatically through an automated process using the API or CLI.

Submitted by cyberguy42· Apr 18, 2026Operate Vault

Question

One of the benefits of using the Vault transit secrets engine is its ability to easily rotate encryption keys. Which of these is true regarding key rotation?

Options

  • AVault automatically rotates the encryption key based on a set period
  • BVault can rotate encryption keys, but cannot enforce restrictions about the minimum encryption key
  • CVault does not maintain the versioned keyring
  • DEncryption keys can be rotated manually by a user, or by an automated process which invokes the

How the community answered

(41 responses)
  • A
    5% (2)
  • B
    2% (1)
  • C
    2% (1)
  • D
    90% (37)

Why each option

Vault's Transit secrets engine allows for encryption key rotation, which can be initiated manually by a user or programmatically through an automated process using the API or CLI.

AVault automatically rotates the encryption key based on a set period

Vault does not automatically rotate encryption keys in the Transit engine based on a set period; rotation must be manually or programmatically triggered.

BVault can rotate encryption keys, but cannot enforce restrictions about the minimum encryption key

Vault can enforce restrictions on key types and sizes, and the Transit engine is designed with security best practices, including strong key management.

CVault does not maintain the versioned keyring

Vault does maintain a versioned keyring for the Transit engine, ensuring that data encrypted with older key versions can still be decrypted, while new encryption uses the latest key.

DEncryption keys can be rotated manually by a user, or by an automated process which invokes theCorrect

The Vault Transit secrets engine supports key rotation, which can be explicitly triggered by a user using the CLI (e.g., `vault write transit/keys/<key_name>/rotate`) or by an automated script or application making an API call. This allows for scheduled or on-demand key management.

Concept tested: Vault Transit engine key rotation

Source: https://developer.hashicorp.com/vault/docs/secrets/transit#key-rotation

Topics

#Vault Transit#Key Rotation#Secrets Engine Operations

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full VAULT-ASSOCIATE-002 Practice