VA-003 Compare and configure secrets engines Practice Question
A security engineer is enabling the Transit secrets engine at the path 'transit/'. They need to encrypt data without ever exposing the plaintext key material to the application, and they want the ciphertext to be safely stored in an external database. They also require the ability to rotate the encryption key periodically without re-encrypting existing data. Which command correctly configures a new encryption key named 'orders' for this purpose?
⚠ Common exam trap
Candidates often confuse the command to enable a secrets engine with the command to create a key within an already enabled engine.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
vault write -f transit/keys/orders
The Transit secrets engine centralizes encryption as a service, allowing applications to encrypt data without managing keys. To create a new named encryption key, the correct command is 'vault write -f transit/keys/orders', which generates a key of the default type (aes256-gcm96) and enables encryption, decryption, and rotation. This satisfies the requirement of not exposing key material and supporting future rotation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
vault write -f transit/keys/orders
Why this is correct
This command creates a named encryption key in the Transit secrets engine at the path transit/keys/orders. The -f flag forces the write without requiring data, which is appropriate because the key is generated by Vault. The key can then be used for encrypt/decrypt operations, and Vault manages the key material internally, supporting rotation and versioning without exposing plaintext.
- ✗
vault write transit/encrypt/orders plaintext=$(base64 <<< "my secret")
Why it's wrong here
This command attempts to encrypt data using a key named 'orders' but does not create the key first. Without prior creation of the encryption key, the operation will fail because the key does not exist. Additionally, this command is for encryption, not key creation, and the scenario requires configuring a new key for later use, not performing an immediate encryption.
- ✗
vault write transit/keys/orders type=rsa-2048
Why it's wrong here
Transit secrets engine does not support an 'rsa-2048' key type for encryption keys. The supported types include 'aes256-gcm96', 'chacha20-poly1305', 'ecdsa-p256', etc. Specifying an invalid type will cause an error. The correct command to create a default key of type aes256-gcm96 is simply 'vault write -f transit/keys/orders' without the type parameter.
- ✗
vault secrets enable -path=orders transit
Why it's wrong here
This command enables a new Transit secrets engine mounted at the path 'orders/'. It does not create an encryption key named 'orders'; instead, it creates a separate mount. While you could then create keys under that mount, the scenario asks for a key within an already enabled 'transit/' engine, so this command does not achieve the goal and would result in an incorrect path.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.