VA-003 Explain encryption as a service Practice Question
A platform team enables the transit engine and creates a key named orders. After several months the team rotates the key. A batch job that had stored ciphertext produced before the rotation now needs to read the original data. What must happen for the batch job to recover the plaintext?
⚠ Common exam trap
The trap here is believing rotation invalidates old ciphertext or requires exporting keys, when Vault retains prior versions and reads the version from the ciphertext.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The batch job should call transit/decrypt with the ciphertext, and Vault will use the key version encoded in the ciphertext prefix.
Rotation in the transit engine adds a new key version while retaining older versions. Ciphertext records the version that produced it, and decrypt automatically selects the correct version. Applications therefore keep working across rotations without re-encrypting data, and rewrap is only needed when the goal is to migrate stored ciphertext to the newest version for policy or performance reasons.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The ciphertext must be decrypted using the old key version, which requires exporting that version first.
Why it's wrong here
Transit keys are non-exportable by design, so exporting a key version is not possible for a standard transit key. The batch job does not need the old key material because Vault retains prior key versions internally and can decrypt ciphertext that references them. This option misunderstands both key exportability and rotation behavior.
- ✓
The batch job should call transit/decrypt with the ciphertext, and Vault will use the key version encoded in the ciphertext prefix.
Why this is correct
Transit ciphertext carries a vault:vN prefix identifying the key version used. Decrypt reads that prefix and applies the matching retained version, so pre-rotation ciphertext still decrypts without any re-encryption. This is why rotation does not break existing data, and why decrypt alone is sufficient for the batch job.
- ✗
The key must be rotated back to the previous version so the batch job can decrypt the stored ciphertext.
Why it's wrong here
Vault key rotation is forward-only and prior versions are retained, not replaced. There is no operation that reverts the current version to an earlier one. Old ciphertext remains decryptable because the earlier version still exists in the key's version history, so rolling back rotation is neither possible nor necessary.
- ✗
The batch job must first call transit/rewrap on each record to convert it to the new key version before decrypting.
Why it's wrong here
Rewrap re-encrypts ciphertext under the latest key version without exposing plaintext, but it is not required to decrypt old data. Vault already knows which version to use from the ciphertext prefix. Requiring rewrap before decrypt adds unnecessary work and misunderstands the purpose of rewrap, which is bulk key migration, not decryption.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 366-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.