Vault Associate · Domain 6 of 9

Vault Associate Domain 6: Encryption as a service

A short, hands-on objective group about the transit engine in practice: encrypting and decrypting data through Vault and rotating encryption keys while existing ciphertext stays readable.

Exam weight estimate
Not published
Official objectives
2
Estimated questions estimate
~3
Suggested study time estimate
3–4 hrs

About 8 min read Reviewed October 2026

Overview

Encryption as a service means applications send data to Vault's transit secrets engine to be encrypted or decrypted with named keys that never leave Vault. HashiCorp lists two objectives here: encrypt and decrypt secrets, and rotate the encryption key. Plaintext must be base64-encoded before it is sent, and transit returns ciphertext prefixed with vault:v1:, where the number is the key version used.

Rotating a key with vault write -f transit/keys/<name>/rotate creates a new version that encrypts all new data, while older versions remain available for decryption. The rewrap endpoint re-encrypts existing ciphertext with the latest version without exposing plaintext to the client, and min_decryption_version can retire old versions once all data has been rewrapped. Vault stores only the keyring, never the application's data.

How it's tested

Expect brief, command-focused items. You may see a vault write transit/encrypt command with its output, a ciphertext string with a version prefix, or a rotation scenario. Questions ask what to send, what comes back, and how key versions affect existing ciphertext.

  • Encrypt or decrypt flow

    A command or output is shown, and you identify the base64 encoding step, the key name or the returned ciphertext format.

  • After rotation

    A key has been rotated, and you decide which key version encrypts new data and whether older ciphertext still decrypts.

  • Upgrade old ciphertext

    Data was encrypted with an old version, and you choose rewrap and min_decryption_version to retire it safely.

Reasoning it through

A key named orders has been rotated twice, and a database row holds vault:v1: ciphertext. A candidate may think rotation invalidated version 1. In fact transit keeps old versions for decryption unless min_decryption_version is raised. The correct step is to call transit/rewrap/orders, which returns vault:v3: ciphertext without revealing plaintext, and later raise the minimum version once all rows are rewrapped.

Objectives 2

Official objectives from the HashiCorp outline, in outline order.

6a Encrypt and decrypt secretsSending data to transit and receiving ciphertext or plaintext.
What it means
This objective covers creating a named transit key and using the encrypt and decrypt endpoints, so applications protect data without managing key material themselves.
What to understand
Enable the engine with vault secrets enable transit and create a key with vault write -f transit/keys/orders; the default type is aes256-gcm96. Encrypt with vault write transit/encrypt/orders plaintext=$(base64 <<< "card data"), which returns ciphertext such as vault:v1:AbC.... Decrypt with vault write transit/decrypt/orders ciphertext=vault:v1:AbC..., which returns base64 plaintext that the client must decode. Policies control which tokens can call encrypt or decrypt for each key, so encrypt-only clients are possible.
How it shows up
Expect to identify the encoding step, the endpoint path, or the prefix that marks transit ciphertext.
Common confusion
Forgetting that decrypt returns base64, so the output still needs decoding.
6b Rotate the encryption keyCreating new key versions and managing old ciphertext.
What it means
Rotating a transit key adds a new key version that becomes the encryption key, while previous versions are kept in the keyring so existing ciphertext can still be decrypted.
What to understand
Rotate with vault write -f transit/keys/orders/rotate, or set auto_rotate_period on the key. New encryptions use the latest version, shown in the vault:vN: prefix. transit/rewrap/orders re-encrypts ciphertext with the latest version without ever returning plaintext. min_decryption_version on the key config blocks decryption with older versions, and min_encryption_version can pin encryption. Trimming removes old versions permanently once they are no longer needed.
How it shows up
A rotation scenario asks whether old data still decrypts and how to move it to the newest version.
Common confusion
Believing rotation re-encrypts stored data automatically; rewrap must be called for each ciphertext.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Transit key

    Named key held in Vault's keyring.

    Remember
    Key material never leaves Vault by default.
    Tested as
    Setup questions.
    Trap
    Expecting to download the key.

  • Base64 plaintext

    Required encoding for encrypt input.

    Remember
    Decrypt output must be decoded.
    Tested as
    Command questions.
    Trap
    Sending raw text.

  • vault:vN: prefix

    Marks transit ciphertext and its key version.

    Remember
    N shows which version encrypted it.
    Tested as
    Output reading questions.
    Trap
    Ignoring the version number.

  • Key rotation

    Adds a new key version.

    Remember
    Old versions still decrypt by default.
    Tested as
    Rotation questions.
    Trap
    Assuming old data breaks.

  • Rewrap

    Re-encrypts ciphertext with the latest version.

    Remember
    Plaintext is never returned.
    Tested as
    Upgrade questions.
    Trap
    Decrypting and re-encrypting instead.

  • min_decryption_version

    Lowest version allowed to decrypt.

    Remember
    Raise it only after rewrapping.
    Tested as
    Retirement questions.
    Trap
    Raising it too early.

  • auto_rotate_period

    Schedules automatic key rotation.

    Remember
    Rotation without manual commands.
    Tested as
    Key policy questions.
    Trap
    Thinking rotation is always manual.

  • aes256-gcm96

    Default transit key type.

    Remember
    Symmetric, supports encrypt and decrypt.
    Tested as
    Key type questions.
    Trap
    Assuming RSA is the default.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Transit operations

ConceptMeaningKey differenceCommon trap
encrypt Base64 plaintext in, ciphertext out Uses latest key version Sending unencoded input
decrypt Ciphertext in, base64 plaintext out Uses version in the prefix Forgetting to decode
rewrap Old ciphertext in, new ciphertext out No plaintext exposed Decrypting first

Key version controls

ConceptMeaningKey differenceCommon trap
rotate Create a new key version New data uses it Expecting stored data to change
min_decryption_version Block decryption with older versions Retires old versions Setting it before rewrap
trim Delete old key versions Permanent removal Trimming versions still in use

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Rotation breaks data

    What candidates pick
    Re-encrypt everything immediately after rotating or lose access.
    Why it looks right
    Key changes often invalidate old data.
    Why it's wrong
    Transit keeps previous versions for decryption until min_decryption_version is raised.

    Clue to watch for Old vault:v1: ciphertext must still be read.

  2. Decrypt then encrypt

    What candidates pick
    Decrypt old ciphertext and encrypt it again to upgrade.
    Why it looks right
    It is the obvious manual approach.
    Why it's wrong
    Rewrap upgrades ciphertext in one call without exposing plaintext to the client.

    Clue to watch for The scenario stresses not exposing plaintext.

  3. Raw text input

    What candidates pick
    Pass plaintext=hello directly.
    Why it looks right
    It looks like a normal parameter.
    Why it's wrong
    Transit requires base64-encoded plaintext, and the decrypt result is base64 too.

    Clue to watch for The command omits an encoding step.

  4. Vault stores ciphertext

    What candidates pick
    Retrieve encrypted records from Vault later.
    Why it looks right
    Vault is known for storing secrets.
    Why it's wrong
    Transit returns ciphertext to the caller and stores only keys, so the application keeps the data.

    Clue to watch for Question asks where data is persisted.

  5. Retire too soon

    What candidates pick
    Raise min_decryption_version right after rotation.
    Why it looks right
    It seems to complete the rotation.
    Why it's wrong
    Ciphertext still on older versions would become undecryptable; rewrap it first.

    Clue to watch for Some records still carry older prefixes.

Answer framework

Work through these steps for any Domain 6 transit question.

  1. Confirm the requirement is encryption without Vault storing the data, which identifies the transit engine and a named key whose policy grants only the operations each client needs.
  2. For encryption, check that plaintext is base64-encoded and sent to transit/encrypt/<key>, expecting vault:vN: ciphertext back.
  3. For decryption, send the full ciphertext including its prefix to transit/decrypt/<key> and decode the base64 result.
  4. After rotation, expect new data to use the newest version while older versions continue to decrypt existing ciphertext.
  5. To retire old versions, rewrap stored ciphertext first, then raise min_decryption_version, and only then consider trimming, because trimmed versions can never decrypt anything again.

Practice question

An application stores records encrypted with the transit key payments. After the key is rotated to version 3, many rows still contain vault:v1: and vault:v2: ciphertext. The team wants all rows on version 3 without the application ever handling plaintext. What should they do?

Want more like this? The Vault Associate practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

This group is compact, so a single focused lab covers most of it. Enable transit on a dev server, create a key, and encrypt a short string using base64 encoding. Decrypt the result and decode it to confirm the round trip. Note the vault:v1: prefix and keep the ciphertext for later.

Rotate the key twice, encrypt a new value and compare prefixes. Decrypt your original version 1 ciphertext to prove it still works, then rewrap it and confirm the prefix changes to the latest version. Set min_decryption_version and try decrypting an old ciphertext to see the error. Write a policy that grants only encrypt on the key and test it with a separate token.

Afterwards, review the transit API page for the encrypt, decrypt, rewrap and key config endpoints, and answer a short set of practice questions. Spending a few hours here gives dependable marks and also strengthens your grasp of secrets engines and policies.

FAQ

How large is Encryption as a service on the exam?

HashiCorp gives no weight for Encryption as a service. It has only two objectives, so we estimate about three questions, but they are concrete and quick to learn with a short lab.

Why must plaintext be base64-encoded?

Transit accepts arbitrary binary data, so it requires base64 input to transport it safely in JSON. Decrypt also returns base64, which the client decodes.

Does rotating a transit key break old ciphertext?

No. Older key versions remain available for decryption by default. New encryptions use the latest version shown in the vault:vN: prefix.

What does rewrap do?

It re-encrypts existing ciphertext with the newest key version and returns the new ciphertext, without exposing plaintext to the caller.

Where is the encrypted data stored?

In the application's own storage. Transit returns ciphertext to the caller and keeps only the encryption keys inside Vault.

How do I stop old key versions from decrypting?

Rewrap stored ciphertext first, then raise min_decryption_version on the key configuration so older versions can no longer decrypt.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 6 knowledge

You have covered encrypting, decrypting and rotating transit keys. Check that you can predict transit outcomes quickly in exam-style questions.

Take the Vault Associate practice test Check your Vault Associate readiness

Keep going