サンプル問題 1： You have a 2GB Base64 binary large object (blob) that needs to be encrypted. Which of the following best describes the transit secrets engine?
A: A data key encrypts the blob locally, and the same key decrypts the blob locally.
B: To process such a large blob. Vault will temporarily store it in the storage backend.
C: Vault will store the blob permanently. Be sure to run Vault on a compute optimized machine
D: The transit engine is not a good solution for binaries of this size.
正解：D
Explanation: The transit secrets engine is not a good solution for binaries of this size, because it is designed to handle cryptographic functions on data in-transit, not data at-rest. The transit secrets engine does not store any data sent to it, so it would require sending the entire 2GB blob to Vault for encryption or decryption, which would be inefficient and impractical. A better solution would be to use the transit secrets engine to generate a data key, which is a high-entropy key that can be used to encrypt or decrypt data locally. The data key can be returned in plaintext or wrapped by another key, depending on the use case. This way, the transit secrets engine only handles the encryption or decryption of the data key, not the data itself, and the data can be stored in any primary data store. Reference: Transit - Secrets Engines | Vault | HashiCorp Developer, Encryption as a service: transit secrets engine | Vault | HashiCorp Developer
サンプル問題 2： How would you describe the value of using the Vault transit secrets engine?
A: Vault has an API that can be programmatically consumed by applications
B: The transit secrets engine ensures encryption in-transit and at-rest is enforced enterprise wide
C: Encryption for application data is best handled by a storage system or database engine, while storing encryption keys in Vault
D: The transit secrets engine relieves the burden of proper encryption/decryption from application developers and pushes the burden onto the operators of Vault
正解：D
Explanation: The transit secrets engine relieves the burden of proper encryption/decryption from application developers and pushes the burden onto the operators of Vault. The transit secrets engine provides encryption as a service, which means that it performs cryptographic operations on data in-transit without storing any data. This allows developers to delegate the responsibility of managing encryption keys and algorithms to Vault operators, who can define and enforce policies on the transit secrets engine. This way, developers can focus on their application logic and data, while Vault handles the encryption and decryption of data in a secure and scalable manner. Reference: Transit - Secrets Engines | Vault | HashiCorp Developer, Encryption as a service: transit secrets engine | Vault | HashiCorp Developer
サンプル問題 3： What is the Vault CLI command to query information about the token the client is currently using?
A: vault lookup token
B: vault token lookup
C: vault lookup self
D: vault self-lookup
正解：B
Explanation: The Vault CLI command to query information about the token the client is currently using is vault token lookup. This command displays information about the token or accessor provided as an argument, or the locally authenticated token if no argument is given. The information includes the token ID, accessor, policies, TTL, creation time, and metadata. This command can be useful for debugging and auditing purposes, as well as for renewing or revoking tokens. Reference: token lookup - Command | Vault | HashiCorp Developer, Tokens | Vault | HashiCorp Developer
