VA-003 Explain encryption as a service Practice Question
A fintech company uses Vault Transit to encrypt credit card numbers (PANs) for PCI-DSS compliance. The security team enforces key rotation every 30 days, and Vault keeps previous key versions to allow decryption of old data. One day, a developer accidentally runs a command that deletes the latest key version before the rotation is complete. The company has Vault configured with key version soft-delete enabled. The incident response team needs to recover the ability to decrypt ciphertexts that were encrypted with the deleted key version. Which action should they take first?
⚠ Common exam trap
HashiCorp often tests the distinction between soft-delete and permanent deletion, and the trap here is that candidates may assume a deleted key version is irrecoverable and jump to a disruptive recovery method like restoring from backup, ignoring the soft-delete feature specifically designed for this scenario.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use the `vault write transit/keys/credit-cards/undelete` API to recover the soft-deleted key version
Vault's Transit secrets engine supports soft-delete for key versions, which allows recovery of a deleted key version using the `undelete` API before the deletion grace period expires. Since the company has soft-delete enabled, the key version is not permanently purged and can be restored without data loss, enabling decryption of ciphertexts encrypted with that version.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Use the `vault write transit/keys/credit-cards/undelete` API to recover the soft-deleted key version
Why this is correct
Soft-delete allows undeletion of key versions quickly and without data loss.
- ✗
Restore the entire Vault cluster from the latest backup snapshot
Why it's wrong here
Backup restoration is time-consuming and may result in loss of recent data; it should be a last resort.
- ✗
Use the `rewrap` endpoint to re-encrypt all ciphertexts with the current key version
Why it's wrong here
Rewrap requires the original key to be available; without it, the ciphertexts cannot be decrypted.
- ✗
Restore the deleted key version from a secondary Vault cluster using replication
Why it's wrong here
Replication may not have the version if it was deleted; also, this assumes a secondary cluster exists and is up-to-date.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.