When Vault is sealed, which are the only two operations available to a Vault administrator? (Select two)

Comprehensive and Detailed in Depth

When Vault is sealed, its functionality is severely restricted to protect encrypted data. The HashiCorp

Vault documentation states: "While Vault is sealed, the only two options available are viewing the

vault status (vault status) and unsealing Vault (vault operator unseal). All the other actions require

Vault to be unsealed and the user to be authenticated." This limitation ensures that no operations

can access or modify data until the Vault is unsealed, enhancing security.

The documentation under "Shamir Seals" further elaborates: "When Vault is sealed, it knows where

its encrypted data is stored but cannot decrypt it because the master key is not in memory. The only

available operations are checking the seal status and initiating the unseal process." Thus:

A (View the status of Vault): The vault status command works when sealed, providing details like seal

state.

E (Unseal Vault): The vault operator unseal command allows administrators to begin unsealing.

Options like configure policies (B), view data in the key/value store (C), rotate the encryption key (D),

and author security policies (F) require an unsealed Vault and authentication, making A and E the

correct selections.

Reference:

HashiCorp Vault Documentation - Seal Concepts: Shamir Seals

HashiCorp Vault Documentation - Vault Status Command