Vault Associate · Domain 7 of 9

Vault Associate Domain 7: Vault architecture fundamentals

How Vault protects its own data and how operators interact with it: the encryption barrier and key hierarchy, sealing and unsealing including auto-unseal, and the environment variables the CLI relies on.

Exam weight estimate
Not published
Official objectives
3
Estimated questions estimate
~4
Suggested study time estimate
4–6 hrs

About 10 min read Reviewed October 2026

Overview

This objective group explains the internal mechanics that every Vault deployment depends on. HashiCorp lists three objectives: describe how Vault encrypts data, explain how to seal and unseal Vault, and configure environment variables. All data written to the storage backend passes through the cryptographic barrier and is encrypted with AES-256 in GCM mode using the encryption key in the keyring. The keyring is protected by the root key, and the root key is protected by the unseal mechanism.

When Vault starts it is sealed: it knows where its storage is but cannot decrypt it. Unsealing with Shamir key shares, or automatically through a cloud KMS, HSM or another Vault's transit engine, gives it access to the root key. The CLI is configured through variables such as VAULT_ADDR, VAULT_TOKEN, VAULT_NAMESPACE, VAULT_CACERT and VAULT_SKIP_VERIFY.

How it's tested

Architecture fundamentals questions test your mental model of Vault's key hierarchy and seal state. Expect statements to evaluate, such as which key encrypts data, scenarios about restarts and emergencies, and CLI items where an environment variable explains an error or controls a connection.

  • Key hierarchy

    You identify which key encrypts data, which protects the keyring, and what the unseal keys or auto-unseal mechanism protect.

  • Sealed or unsealed

    A node state is described, and you decide what operations are possible and what command or event changes the state.

  • Fix the CLI environment

    A CLI error such as a connection refused or TLS failure is shown, and you choose the environment variable that resolves it.

Reasoning it through

A node restarts after patching, and applications receive errors saying Vault is sealed. Restarting again will not help because every start begins sealed. With Shamir sealing, key holders must run vault operator unseal until the threshold is met. If the cluster used auto-unseal, the cause would instead be lost access to the KMS, since recovery keys cannot unseal Vault.

Objectives 3

Official objectives from the HashiCorp outline, in outline order.

7a Describe how Vault encrypts dataThe barrier, the keyring and the root key.
What it means
Vault encrypts everything it writes to storage at its cryptographic barrier. Data is encrypted with the encryption key held in the keyring, using AES-256-GCM, so the storage backend only ever sees ciphertext.
What to understand
The key hierarchy has three layers. The encryption key or keys in the keyring encrypt data. The root key, formerly called the master key, encrypts the keyring. The root key is itself protected by Shamir unseal key shares or by an external seal such as a cloud KMS or HSM. Because data is encrypted before it leaves Vault, the storage backend does not need to be trusted. vault operator rotate adds a new encryption key to the keyring.
How it shows up
Expect questions on which key encrypts data and why the storage backend is considered untrusted.
Common confusion
Thinking the unseal keys encrypt data directly; they only protect the root key.
7b Explain how to seal and unseal VaultSeal states, unsealing methods and when to seal manually.
What it means
A sealed Vault cannot decrypt its data and refuses almost all requests. Unsealing reconstructs or retrieves the root key so Vault can decrypt the keyring and serve requests. Every Vault node starts sealed.
What to understand
With the default Shamir seal, a threshold of key holders each run vault operator unseal with a share until the root key is rebuilt. With auto-unseal, Vault asks a trusted service such as AWS KMS, Azure Key Vault, GCP Cloud KMS, an HSM or another Vault's transit engine to decrypt the root key at startup. Auto-unseal uses recovery keys for operations such as generate-root, but recovery keys cannot unseal. vault operator seal, which needs sudo, seals Vault in an emergency. vault status shows seal state.
How it shows up
Scenarios ask what a sealed Vault can do, how to unseal it, or what changes when auto-unseal is used.
Common confusion
Believing recovery keys can unseal an auto-unseal cluster when the KMS is unavailable.
7c Configure environment variablesVariables that configure the Vault CLI and clients.
What it means
The Vault CLI and many clients read environment variables to know which server to contact, which token to use and how to handle TLS, so commands do not need repeated flags.
What to understand
VAULT_ADDR sets the server address and defaults to https://127.0.0.1:8200. VAULT_TOKEN supplies a token and overrides the token helper file ~/.vault-token. VAULT_NAMESPACE selects an Enterprise or HCP namespace. VAULT_CACERT points to a CA certificate for TLS verification, and VAULT_SKIP_VERIFY disables verification for testing only. VAULT_FORMAT sets output format, and VAULT_CLIENT_CERT and VAULT_CLIENT_KEY support TLS client authentication. A dev server prints export commands for VAULT_ADDR because it listens on plain HTTP.
How it shows up
A CLI error is shown, and you pick the variable that fixes it, such as an address or certificate setting.
Common confusion
Setting VAULT_SKIP_VERIFY in production instead of supplying the correct CA with VAULT_CACERT.

High-yield concepts

The terms, rules and formulas this domain turns into questions most often.

  • Cryptographic barrier

    Boundary where Vault encrypts all stored data.

    Remember
    Storage only sees ciphertext.
    Tested as
    Encryption questions.
    Trap
    Assuming storage must be trusted.

  • Encryption key and keyring

    Keys that encrypt data, kept in the keyring.

    Remember
    AES-256-GCM; rotated with vault operator rotate.
    Tested as
    Key hierarchy questions.
    Trap
    Confusing with transit keys.

  • Root key

    Key that encrypts the keyring.

    Remember
    Formerly called the master key.
    Tested as
    Key hierarchy questions.
    Trap
    Thinking it encrypts data directly.

  • Shamir seal

    Root key split into unseal key shares.

    Remember
    Threshold of shares unseals Vault.
    Tested as
    Unseal questions.
    Trap
    Expecting one share to be enough.

  • Auto-unseal

    Trusted KMS, HSM or transit protects the root key.

    Remember
    Nodes unseal automatically at start.
    Tested as
    Deployment questions.
    Trap
    Forgetting the KMS dependency.

  • Recovery keys

    Shares used with auto-unseal for privileged operations.

    Remember
    Cannot unseal Vault.
    Tested as
    Recovery questions.
    Trap
    Using them to unseal.

  • vault operator seal

    Manually seals a running node.

    Remember
    Requires sudo; used in emergencies.
    Tested as
    Incident questions.
    Trap
    Thinking it deletes data.

  • VAULT_ADDR

    Address of the Vault server.

    Remember
    Defaults to https://127.0.0.1:8200.
    Tested as
    CLI questions.
    Trap
    Leaving it unset for a dev server on HTTP.

  • VAULT_TOKEN

    Token used by the CLI.

    Remember
    Overrides ~/.vault-token.
    Tested as
    CLI questions.
    Trap
    Confusing it with an accessor.

  • VAULT_CACERT / VAULT_SKIP_VERIFY

    TLS verification settings.

    Remember
    Use the CA file; skip only in testing.
    Tested as
    TLS error questions.
    Trap
    Skipping verification in production.

Side by side

Concepts candidates mix up, compared on the point that decides the answer.

Vault key hierarchy

ConceptMeaningKey differenceCommon trap
Encryption key Encrypts data at the barrier Lives in the keyring Thinking unseal keys do this
Root key Encrypts the keyring Protected by the seal Calling it the data key
Unseal shares / KMS key Protect the root key Used only to unseal Expecting them to decrypt data

Shamir seal vs. auto-unseal

ConceptMeaningKey differenceCommon trap
Shamir Key holders enter shares after each start Manual threshold unseal Assuming nodes self-unseal
Auto-unseal KMS, HSM or transit decrypts root key No manual unseal; external dependency Thinking recovery keys unseal

Exam traps

Each trap is an answer that looks right. Learn the clue that should change your mind.

  1. Unseal keys encrypt data

    What candidates pick
    Say the unseal keys encrypt secrets in storage.
    Why it looks right
    They are the most visible keys.
    Why it's wrong
    Data is encrypted by the keyring's encryption key; unseal shares only protect the root key.

    Clue to watch for The question asks which key encrypts stored data.

  2. Recovery keys unseal

    What candidates pick
    Use recovery keys when the KMS is unreachable.
    Why it looks right
    They are distributed like unseal keys.
    Why it's wrong
    Recovery keys authorize operations such as generate-root but cannot unseal an auto-unseal cluster.

    Clue to watch for The cluster uses auto-unseal and the KMS is down.

  3. Restart to unseal

    What candidates pick
    Restart a sealed node to bring it back.
    Why it looks right
    Restarts fix many service issues.
    Why it's wrong
    Vault always starts sealed, so a restart leaves it sealed until unsealing occurs.

    Clue to watch for A node reports sealed after a restart.

  4. Trust the storage

    What candidates pick
    Encrypt the storage backend to protect secrets.
    Why it looks right
    Encryption at rest seems necessary.
    Why it's wrong
    Vault encrypts data at the barrier before writing it, so storage sees only ciphertext.

    Clue to watch for The question asks why storage is untrusted.

  5. Skip TLS checks

    What candidates pick
    Set VAULT_SKIP_VERIFY to fix certificate errors in production.
    Why it looks right
    It makes the error disappear.
    Why it's wrong
    Skipping verification removes protection; point VAULT_CACERT at the correct CA instead.

    Clue to watch for A TLS verification error on a production cluster.

  6. Seal deletes data

    What candidates pick
    Avoid vault operator seal during incidents for fear of data loss.
    Why it looks right
    Sealing sounds destructive.
    Why it's wrong
    Sealing only discards the in-memory root key; data stays encrypted in storage and is restored by unsealing.

    Clue to watch for An active intrusion requires stopping all access.

Answer framework

Use these steps for any Domain 7 architecture or environment variable scenario.

  1. Place the question in the key hierarchy: encryption key for data, root key for the keyring, seal mechanism for the root key.
  2. Determine the seal type in use, Shamir or auto-unseal, because it decides how unsealing happens and what recovery keys can do.
  3. Remember every node starts sealed and a sealed node serves almost nothing apart from status and unseal requests.
  4. For incidents, consider vault operator seal to stop all access immediately without losing stored data, then unseal once the threat is contained.
  5. For CLI problems, check VAULT_ADDR, VAULT_TOKEN, VAULT_NAMESPACE and VAULT_CACERT before considering other causes, and prefer a correct CA file over disabling verification.

Practice question

A Vault cluster configured with AWS KMS auto-unseal is restarted during a regional outage that makes the KMS key unreachable. An operator suggests entering the recovery keys to bring the nodes online. What will happen?

Want more like this? The Vault Associate practice test has questions for every domain.

Checklist

0 of 10

Tick each one you can do without notes. Your ticks stay in this browser.

Study strategy

Draw the key hierarchy from memory until it is automatic: data, encrypted by the encryption key in the keyring, which is encrypted by the root key, which is protected by Shamir shares or an external seal. Most questions in this group become simple once that picture is fixed.

Then move beyond dev mode, because a dev server is already unsealed. Run a server with a small configuration file using integrated storage, initialise it with vault operator init, and unseal it with the threshold of shares. Seal it with vault operator seal, check vault status, and unseal it again. Read the auto-unseal and recovery key documentation and note what changes in each step.

Finally, practise environment variables. Unset VAULT_ADDR and observe the connection error, then set it. Point VAULT_CACERT at a self-signed CA on a TLS listener. Review missed practice questions and compare each wrong option to the hierarchy you drew.

FAQ

How many exam questions cover Vault architecture fundamentals?

No weight is published for Vault architecture fundamentals. With three objectives we plan for about four questions, though seal concepts also support the deployment architecture group.

What does sealed mean?

A sealed Vault knows where its storage is but cannot decrypt it because it does not have the root key in memory. It rejects almost all requests until unsealed.

Which key actually encrypts my secrets?

The encryption key in Vault's keyring, using AES-256-GCM. The root key protects the keyring, and the seal protects the root key.

Can recovery keys unseal Vault?

No. With auto-unseal, recovery keys are used for operations such as generate-root. Unsealing depends on reaching the configured KMS, HSM or transit seal.

What is the default VAULT_ADDR?

It defaults to https://127.0.0.1:8200. A dev server listens on HTTP, so you must export VAULT_ADDR with http:// before using the CLI.

When should I seal Vault manually?

In an emergency such as a suspected intrusion. Sealing stops all access immediately while leaving encrypted data intact for later unsealing.

Other Cybersecurity certifications

Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.

Test your Domain 7 knowledge

You have covered barrier encryption, sealing and unsealing, and CLI environment variables. Test whether you can reason through seal scenarios accurately.

Take the Vault Associate practice test Check your Vault Associate readiness

Keep going