Valid Vault-Associate Dumps shared by ExamDiscuss.com for Helping Passing Vault-Associate Exam! ExamDiscuss.com now offer the newest Vault-Associate exam dumps, the ExamDiscuss.com Vault-Associate exam questions have been updated and answers have been corrected get the newest ExamDiscuss.com Vault-Associate dumps with Test Engine here:
You have a 2GB Base64 binary large object (blob) that needs to be encrypted. Which of the following best describes the transit secrets engine?
Correct Answer: D
The transit secrets engine is not a good solution for binaries of this size, because it is designed to handle cryptographic functions on data in-transit, not data at-rest. The transit secrets engine does not store any data sent to it, so it would require sending the entire 2GB blob to Vault for encryption or decryption, which would be inefficient and impractical. A better solution would be to use the transit secrets engine to generate a data key, which is a high-entropy key that can be used to encrypt or decrypt data locally. The data key can be returned in plaintext or wrapped by another key, depending on the use case. This way, the transit secrets engine only handles the encryption or decryption of the data key, not the data itself, and the data can be stored in any primary data store. Reference: Transit - Secrets Engines | Vault | HashiCorp Developer, Encryption as a service: transit secrets engine | Vault | HashiCorp Developer
