VA-003 Explain encryption as a service Practice Question
A financial services company uses HashiCorp Vault's transit engine to encrypt customer credit card numbers. The application sends each credit card number individually to Vault for encryption, and the response time is acceptable. However, during peak hours, the company needs to encrypt large batches of 10,000 credit card numbers. Users report that encrypting the entire batch takes several minutes, causing timeouts. The Vault cluster is healthy and not under high load. The security team wants to reduce the encryption time without changing the encryption algorithm or key strength. What should they do?
⚠ Common exam trap
Many exam-takers confuse 'parallel encryption' (which Vault inherently supports via concurrent API calls) with reducing the number of API calls, or mistakenly think that changing the key type (Option D) or enabling convergent encryption (Option C) would improve performance, when the actual solution is batching input to minimize network overhead.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the `batch_input` parameter to encrypt multiple plaintexts in one API call.
The `batch_input` parameter allows sending multiple plaintexts in a single API call to Vault's transit engine, significantly reducing the overhead of individual HTTP requests and TLS handshakes. This directly addresses the batch encryption timeout issue without changing the encryption algorithm or key strength, as the Vault cluster is healthy and not under load, indicating the bottleneck is network round-trips, not cryptographic computation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable key derivation on the transit key to allow parallel encryption.
Why it's wrong here
Key derivation creates a derived key per context, adding a derivation step to every encrypt call rather than enabling parallelism; Vault still processes each request serially per item. It is tempting because derived keys are the correct choice when you need per-tenant or per-context cryptographic isolation, not for batch throughput.
- ✓
Use the `batch_input` parameter to encrypt multiple plaintexts in one API call.
Why this is correct
The batch_input parameter lets the transit engine encrypt many plaintexts in a single API call, amortising network round trips and per-request overhead. This cuts the several-minute batch time without altering the encryption algorithm or key strength.
- ✗
Enable convergent encryption to reuse ciphertexts.
Why it's wrong here
Convergent encryption only makes identical plaintexts produce identical ciphertexts, which saves storage and deduplication, not per-request encryption latency; each of the 10,000 values still needs its own Vault call. It is tempting because it reduces work in deduplication scenarios, but it also weakens security for card numbers.
- ✗
Switch to an AES-256-GCM key for faster encryption.
Why it's wrong here
AES-256-GCM is already the default cipher for Vault transit keys, so switching to it changes nothing about throughput; the bottleneck is per-item HTTP round trips, not the algorithm. It tempts because GCM is genuinely fast and authenticated, and would be the right pick when choosing a cipher for a new key.
Quick reference
Symmetric Encryption Algorithm Comparison
| Algorithm | Key Size | Block Size | Status | Notes |
|---|---|---|---|---|
| AES-128 | 128-bit | 128-bit | Current standard | NIST approved; WPA3, TLS |
| AES-256 | 256-bit | 128-bit | Current standard | Preferred for sensitive / govt data |
| 3DES | 112-bit effective | 64-bit | Deprecated (2023) | Replaced by AES |
| DES | 56-bit | 64-bit | Broken | Cracked in < 24 h; never deploy |
| ChaCha20 | 256-bit | Stream cipher | Current | TLS 1.3, WireGuard |
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.