VA-003 Explain encryption as a service Practice Question
A security architect is designing a service that uses the Vault transit engine to encrypt records. The architect wants to limit the blast radius if an application token is stolen. The application only ever writes new encrypted records and never needs to read them back. Which transit policy capability set should be granted to the application token?
⚠ Common exam trap
The trap here is treating encrypt and decrypt as an inseparable pair, when Vault policies allow granting only encrypt for write-only clients.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
encrypt only on the transit key path
Vault policies separate capabilities per path, so a write-only application should receive only encrypt on the specific transit key. Withholding decrypt means compromised credentials cannot expose stored plaintext. Least privilege for encryption as a service is expressed by granting exactly the capabilities the client needs on the narrowest path, rather than bundling decrypt or administrative capabilities.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
encrypt only on the transit key path
Why this is correct
Restricting the token to encrypt means a stolen token can only produce new ciphertext, not reveal existing plaintext. This directly limits blast radius for a write-only application. Vault policies are capability based, so listing encrypt without decrypt on the key path enforces this separation cleanly.
- ✗
read on the transit key path and encrypt capability
Why it's wrong here
Read on a transit key path returns key metadata such as versions and configuration, not the key material itself, but it is still unnecessary for a write-only client. More importantly, read does not grant encrypt, so pairing it with encrypt is redundant while adding exposure of key configuration details the application does not need.
- ✗
encrypt and decrypt on the transit key path
Why it's wrong here
Granting decrypt to a token that only writes records violates least privilege. If the token is stolen, an attacker could recover plaintext for every ciphertext the key protects. The scenario states the application never reads records back, so decrypt is unnecessary and expands the blast radius rather than limiting it.
- ✗
sudo on the transit key path
Why it's wrong here
Sudo is a root-protected capability used for sensitive operations such as key deletion or trimming, not for ordinary encryption. Granting sudo to an application token would be a severe privilege escalation and does not by itself provide the encrypt capability. This is far broader than the write-only requirement.
Quick reference
AAA Protocol Comparison
| Protocol | Port(s) | Encryption | Transport | Primary Use |
|---|---|---|---|---|
| RADIUS | 1812 / 1813 | Password only | UDP | Network access control |
| TACACS+ | 49 | Full packet | TCP | Device administration |
| Diameter | 3868 | Full session | TCP / SCTP | Carrier / mobile networks |
| 802.1X | — | EAP-based | Layer 2 | Port-based access control |
TACACS+ encrypts the entire packet; RADIUS only encrypts the password field — a key exam distinction.
Go deeper
Related to this question
About these practice questions
One of 366 original VA-003 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.