VA-003 Explain encryption as a service Practice Question
A security policy requires that encryption keys used in transit must never leave Vault's memory. However, development teams need to perform encryption offline in CI/CD pipelines. How can this be accomplished?
⚠ Common exam trap
Watch out — candidates often think offline encryption is impossible if keys cannot leave Vault, but Vault's datakey endpoint provides a wrapped key that can be used offline without exposing the underlying transit key.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Use Vault's datakey endpoint to get a wrapped key that can be unwrapped offline
Vault's `datakey` endpoint generates a data encryption key (DEK) that is wrapped by a Vault-managed key. The wrapped DEK can be safely stored and used offline in CI/CD pipelines, while the unwrapped key material never leaves Vault's memory — the DEK is unwrapped only when needed, and the wrapping key remains in Vault. This satisfies the policy requirement that encryption keys used in transit must never leave Vault's memory, as the DEK itself is not a transit key but a data key that can be used offline.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Use exportable keys and export them
Why it's wrong here
Exporting keys would expose them outside Vault, violating policy.
- ✗
Use Vault's transit encrypt with context
Why it's wrong here
Encrypting via API still requires online access to Vault.
- ✗
Use Vault's ciphertext rewrap
Why it's wrong here
Rewrap requires the original ciphertext and does not provide offline encryption capability.
- ✓
Use Vault's datakey endpoint to get a wrapped key that can be unwrapped offline
Why this is correct
The datakey response includes a ciphertext that can be decrypted later to retrieve the data key for local encryption.
- ✗
It is not possible; keys must stay in Vault
Why it's wrong here
Datakey provides a solution that keeps the transit key secure.
Go deeper
Related to this question
About these practice questions
This VA-003 question is part of Courseiva's 498-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.