VA-003 Explain encryption as a service Practice Question
A company wants to encrypt sensitive data at rest in its application using HashiCorp Vault. They need to ensure that each application instance uses a unique encryption key without storing keys locally. Which TWO actions should the security team take to meet these requirements?
⚠ Common exam trap
The VA-003 exam often tests the distinction between key derivation (which creates unique per-instance keys from a single master key) and key rotation (which changes the key over time but does not provide uniqueness per instance), leading candidates to mistakenly select automatic key rotation as the solution.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable key derivation on the transit key.
Enabling key derivation on a transit key allows each application instance to derive a unique encryption key from a single master key using a context value. This ensures that each instance uses a distinct key without storing keys locally, as the derived key is never persisted and is computed on-the-fly during encryption and decryption operations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Create a separate transit key for each application instance.
Why it's wrong here
Impractical and not needed with key derivation.
- ✓
Enable key derivation on the transit key.
Why this is correct
Allows deriving unique keys per context without storing them.
- ✗
Enable automatic key rotation on the transit key.
Why it's wrong here
Rotation changes the key over time, not per-instance.
- ✗
Store encryption keys in the KV secrets engine.
Why it's wrong here
KV is for static secrets, not encryption operations.
- ✓
Use the transit secrets engine to encrypt data.
Why this is correct
Transit provides encryption as a service.
Go deeper
Related to this question
About these practice questions
One of 498 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.