Question 1
What is required to seal Vault?
- AOption A:
A single operator with root privileges.
- BOption B:
3 Shamir’s keys.
- COption C:
A threshold of operators with root privileges
- DOption D:
The root key.
Show answer and explanation
Correct answer: A
Sealing Vault is an administrative operation performed against the /sys/seal endpoint or by using the equivalent operator command. It does not require Shamir unseal keys, because those are used to unseal Vault, not to seal it. It also does not require the root key to be manually supplied. A quorum or threshold of key holders is needed for unsealing in Shamir mode, but sealing is a different action. The best answer is a single operator with sufficient root-level privilege, meaning a token with the root policy or the required sudo capability on the seal path. HashiCorp’s /sys/seal API documentation states that sealing requires a token with the root policy or sudo capability on the path.
================