VA-003 Explain Vault architecture Practice Question
A company with strict security requirements uses Vault's Transit secrets engine to encrypt data in a microservices architecture. They have multiple applications that each require a unique encryption key. The security team wants to enforce key rotation every 30 days for all keys, and also require that keys be destroyed after they are no longer used. The application team is concerned that key rotation might cause downtime because applications need to re-encrypt data. The Vault architect needs to design a key management solution. What is the best approach?
⚠ Common exam trap
HashiCorp often tests the misconception that key rotation in Vault automatically re-encrypts existing ciphertext, when in fact the Transit engine only creates new key versions and relies on applications to re-encrypt data separately.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the Transit engine's key rotation capability with versioning and configure applications to use the latest key version for encryption, while keeping old versions for decryption.
Vault's Transit secrets engine supports key rotation with versioning, where each rotation creates a new key version while retaining older versions for decryption. This allows applications to always encrypt using the latest version (via the `encrypt` endpoint) and decrypt using any previous version (via the `decrypt` endpoint), ensuring zero downtime during rotation. The security team's requirement for key destruction after disuse can be met by trimming or deleting old key versions once all data encrypted with them is re-encrypted.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the Transit engine's key rotation capability with versioning and configure applications to use the latest key version for encryption, while keeping old versions for decryption.
Why this is correct
Transit key versioning decouples encryption from decryption: new writes use the latest key version, while older versions remain available to decrypt existing ciphertext. This satisfies the 30-day rotation requirement without downtime, since applications never need to re-encrypt stored data.
- ✗
Manually rotate keys every 30 days and update applications with new key IDs.
Why it's wrong here
Manual rotation leaves keys unchanged between 30-day windows, cannot enforce destruction, and forces application downtime while IDs are redeployed. It is tempting because it requires no new tooling, and it would suffice if keys were few, static and rotation were an occasional administrative task.
- ✗
Set the key TTL to 30 days and configure Vault to automatically re-encrypt data when keys are rotated.
Why it's wrong here
Vault's Transit engine never re-encrypts stored ciphertext; rotation only adds a new key version, leaving existing data readable via old versions. Automatic re-encryption is not a Vault capability, so the requirement must be met by application-driven rewrapping. Key TTLs suit auto-destruction of unused keys, not rotation scheduling.
- ✗
Use a single key for all applications and rotate it by creating a new key and deleting the old one.
Why it's wrong here
A single shared key breaks the per-application key isolation the architecture requires, and deleting the old key immediately makes ciphertext encrypted under it permanently undecryptable. Rotation via a new key version preserves old versions for decryption; deletion belongs only after data is rewrapped and the key is genuinely unused.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 366-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.