A water-meter gateway must encrypt readings with a symmetric key and separately sign firmware manifests. Which Vault algorithm pairing matches those jobs?
Select an answer to reveal the explanation.
Short Explanation
Same key both ways for locking readings—that is AES. Proving who sealed the firmware wants a signing algorithm such as ECDSA or RSA. ECDSA does not encrypt; AES does not sign.
Full Explanation
Symmetric and asymmetric algorithms serve different jobs for a water-meter gateway. AES is the fit for encrypt and decrypt of meter readings: the same key material seals and opens the payload. Signing firmware manifests needs a sign/verify algorithm such as ECDSA or RSA so verifiers can check integrity and origin with a public key without holding the signing private key. Pair AES for readings with ECDSA (or RSA) for manifests—not the reverse.
Using ECDSA alone for encrypting the readings fails by concept: elliptic-curve signature algorithms are for sign/verify, not bulk payload encryption of meter data. Using AES alone for signing firmware manifests fails because symmetric keys do not provide the asymmetric sign/verify model Vault documents for signature operations; AES encrypts, it does not replace digital signatures. Claiming RSA is only for encryption and never for sign/verify in Vault fails as well: RSA is commonly used for sign/verify (and related wrap) operations, not solely for encryption.
Exam caveat: encrypt/decrypt → symmetric (AES); sign/verify → asymmetric (ECDSA/RSA). Operational check: encrypt a sample reading with an AES key in Vault, decrypt successfully with the same key; sign a firmware manifest with ECDSA or RSA and verify with the public component—and confirm attempts to “sign with AES” or “encrypt readings with ECDSA alone” are rejected by design.