VA-003 Explain Vault architecture Practice Question
A company stores static secrets in Vault and requires that all data is encrypted at rest in the storage backend. Which Vault feature provides this encryption?
⚠ Common exam trap
HashiCorp often tests the misconception that storage backend encryption (e.g., Consul's built-in encryption) is required or sufficient, when in fact Vault's barrier provides mandatory encryption at rest that is independent of the backend.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Vault's storage encryption via the barrier.
C is correct because Vault's storage encryption is handled by the security barrier, which automatically encrypts all data written to the storage backend using a 256-bit AES-GCM encryption key. This ensures that data is encrypted at rest regardless of the storage backend's own capabilities, meeting the requirement without relying on backend-specific features.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The storage backend must be configured to encrypt data.
Why it's wrong here
Vault encrypts data at rest itself before writing to any storage backend, so backend-level encryption is unnecessary and cannot be assumed. Configuring storage encryption is the right approach only for external systems such as a database or disk volume outside Vault's own barrier.
- ✗
The transit secrets engine for encrypting secrets.
Why it's wrong here
The transit engine encrypts data in transit through Vault's API before it reaches storage; it never encrypts Vault's own storage backend. It is tempting because transit is Vault's cryptographic engine, but it is the correct choice for application-level encryption-as-a-service, not for securing secrets at rest.
- ✓
Vault's storage encryption via the barrier.
Why this is correct
Vault encrypts all data at rest in the storage backend using its barrier, an AES-GCM encryption layer wrapping every entry before it reaches Consul, Raft, or any other backend. This satisfies the requirement that static secrets remain encrypted within the storage layer itself.
- ✗
The storage backend's built-in encryption (e.g., Consul's encryption).
Why it's wrong here
Consul's built-in encryption protects Consul's own gossip and RPC traffic, not the Vault data written to it; Vault performs its own barrier encryption before writing. It is tempting because Consul does offer encryption, but that is the correct choice for securing Consul cluster communication, not Vault's stored secrets.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.