A web application uses Vault’s transit secrets engine to encrypt data in-transit. If an attacker intercepts the data in transit, which of the following statements are true? (Choose two.)
A web application uses Vault’s transit secrets engine to encrypt data in-transit. If an attacker intercepts the data in transit, which of the following statements are true? (Choose two.)
Using Vault's transit secrets engine, the correct approach includes rotating the encryption keys and moving the min_decryption_version forward to ensure intercepted data cannot be decrypted by an attacker with access to old keys. Additionally, if an attacker intercepts the data in transit, they would only capture encrypted bits, assuming TLS is used, preventing them from interpreting the data.
B(first) and C B(first): https://developer.hashicorp.com/vault/docs/secrets/transit C: https://developer.hashicorp.com/vault/tutorials/encryption-as-a-service/eaas-transit
B (first) and C A > if you just rotate the encryption key, the attacker could use previous version of the key to decrypt (if he had access to the keyring) B (second) > Sealing the Vault doesn't make sense. I f the attacker has the decryption key also, sealing the Vault wouldn't make a difference. The right approach is to rotate the key and move foward the min_decryption_version
B and D
B and C https://developer.hashicorp.com/vault/api-docs/secret/transit#min_decryption_version