VA-003 Compare and configure secrets engines Practice Question
A company needs to issue short-lived TLS certificates for internal microservices. They want to set up a private CA using Vault. Which steps are required to configure the PKI secrets engine?
⚠ Common exam trap
HashiCorp often tests the correct sequence of operations in Vault PKI setup, and the trap here is that candidates confuse the order of enabling the engine versus generating the CA, or they incorrectly assume an intermediate CA is always required for a private CA setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable PKI, generate root CA, create a role, issue certificates
The correct order to configure the Vault PKI secrets engine is: first enable the PKI secrets engine at a path, then generate a root CA certificate (which creates the CA's key pair and self-signed certificate), then create a role that defines certificate issuance parameters (such as allowed domains and TTL), and finally issue certificates using that role. This sequence ensures the CA exists before roles reference it, and roles exist before certificates are issued.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable PKI, create a role, generate root CA, issue certificates
Why it's wrong here
Root CA generation must come before role creation, as the role references the CA.
- ✗
Generate root CA, enable PKI, create a role, issue certificates
Why it's wrong here
You cannot generate a root CA before enabling the engine.
- ✗
Enable PKI, generate intermediate CA, generate root CA, issue certificates
Why it's wrong here
For a simple private CA, a root CA is sufficient; an intermediate is optional.
- ✓
Enable PKI, generate root CA, create a role, issue certificates
Why this is correct
This is the correct order: enable, generate root, create role, issue.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 498 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.