VA-003 Explain encryption as a service Practice Question
A DevOps team uses Vault's transit engine to encrypt secrets in CI/CD pipelines. They report that encryption operations are failing with 'permission denied' errors. The team has a policy granting 'create' and 'update' capabilities on the transit key path. What is the most likely missing capability?
⚠ Common exam trap
HashiCorp often tests the misconception that 'write' or 'create' capabilities on a key path implicitly grant the ability to encrypt data, when in fact Vault requires explicit 'encrypt' and 'decrypt' capabilities for data-plane operations.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The 'encrypt' capability is missing.
The Vault transit engine uses distinct capabilities for key management versus data operations. 'Create' and 'update' allow managing the key itself (e.g., creating or rotating the key), but encryption of data requires the 'encrypt' capability on the transit key path. Without 'encrypt', the API call to encrypt data fails with a 'permission denied' error, even if the key exists and is properly configured.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The 'read' capability is missing.
Why it's wrong here
Read is for key metadata, not encrypt.
- ✓
The 'encrypt' capability is missing.
Why this is correct
Encrypt capability is required for encryption operations.
- ✗
The 'delete' capability is missing.
Why it's wrong here
Delete is not needed for encryption.
- ✗
The 'list' capability is missing.
Why it's wrong here
List is for enumerating keys.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.