Over a few years, you have a lot of data that has been encrypted by...

Comprehensive and Detailed In-Depth Explanation:

The Transit rewrap feature re-encrypts data safely. The Vault documentation states:

" Luckily, Vault provides an easy way of re-wrapping encrypted data when a key is rotated. Using the rewrap API endpoint, a non-privileged Vault entity can send data encrypted with an older version of the key to have it re-encrypted with the latest version. The application performing the re-wrapping never interacts with the decrypted data. "

— Transit Rewrap Tutorial

C : Correct. Rewrap avoids decryption risks:

" Using the transit rewrap feature in Vault allows you to re-encrypt the data without decrypting it first. "

— Transit Rewrap Tutorial

A : Rotation doesn’t re-encrypt existing data.

B : Manual decryption exposes data.

D : Master key changes don’t affect Transit data.