VA-003 Explain encryption as a service Practice Question
A developer wants to encrypt a password before storing it in a database. The encryption must be deterministic so that the same plaintext always produces the same ciphertext. Which encryption mode should be used in the transit secrets engine?
⚠ Common exam trap
HashiCorp often tests the misconception that any AES-GCM mode is deterministic, but in practice, AES-GCM requires a unique nonce for each encryption, making it non-deterministic unless combined with convergent encryption or a fixed nonce (which would break security guarantees).
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
convergent-encryption
The transit secrets engine in Vault supports convergent encryption, which is a deterministic encryption mode where the same plaintext and context always produce the same ciphertext. This is achieved by using the plaintext itself as part of the encryption key derivation, ensuring repeatable output. The question specifically requires deterministic encryption, making convergent encryption the correct choice.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
chacha20-poly1305
Why it's wrong here
ChaCha20-Poly1305 also uses a random nonce, producing different ciphertexts.
- ✓
convergent-encryption
Why this is correct
Convergent encryption derives the nonce from the plaintext and context, making output deterministic.
- ✗
aes128-gcm96
Why it's wrong here
AES128-GCM96 is a variant of AES-GCM and still non-deterministic.
- ✗
aes-gcm
Why it's wrong here
AES-GCM uses a random nonce, making ciphertext non-deterministic.
- ✗
padding
Why it's wrong here
Padding is not an encryption mode; it's an option for some encryption operations.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.