Which command will generate a new transit key?

The correct answer is C. vault write -f transit/keys/my-key. To generate a new encryption key within the Vault Transit secrets engine, the vault write command must be used, typically with the -f flag for force, to create a new key at a specified path.

Submitted by naveen.iyer· Apr 18, 2026Administer Vault

Question

Which command will generate a new transit key?

Options

Avault put transit/keys/my-key
Cvault write -f transit/keys/my-key
Dvault create transit/keys/my-key

How the community answered

(61 responses)

A
5% (3)
C
93% (57)
D
2% (1)

Why each option

To generate a new encryption key within the Vault Transit secrets engine, the `vault write` command must be used, typically with the `-f` flag for force, to create a new key at a specified path.

Avault put transit/keys/my-key

`vault put` is not a standard Vault CLI command for creating resources like Transit keys; `vault write` is the primary command for such operations.

Cvault write -f transit/keys/my-keyCorrect

The correct command to create a new named encryption key in the Transit secrets engine is `vault write -f transit/keys/my-key`. The `vault write` command is used for writing data to a path, and for creating keys, the `-f` (force) flag is often used when no payload is explicitly provided to confirm creation.

Dvault create transit/keys/my-key

`vault create` is not a standard Vault CLI command for creating keys; `vault write` is the correct verb for this action.

Concept tested: Vault Transit engine key creation

Source: https://developer.hashicorp.com/vault/api-docs/secrets/transit#create-update-key

Topics

#Transit Secret Engine#CLI Commands#Key Management

Community Discussion

No community discussion yet for this question.

Full VAULT-ASSOCIATE-002 Practice