VA-003 Explain encryption as a service Practice Question
A security team encrypts records with a transit key and stores the resulting ciphertext. Months later they rotate the key several times. An application now needs to read old records, and the team also wants future writes to use only the newest key version without breaking decryption of the legacy rows. What is the accurate behavior of the transit engine in this situation?
⚠ Common exam trap
The trap here is believing that rotating a key makes previously encrypted data undecryptable, when version retention is specifically designed to prevent that outcome.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Old ciphertext decrypts normally because the version prefix selects the correct key version, and new encrypt calls automatically use the latest version.
Transit ciphertext carries its key version, and Vault keeps prior versions available for decryption by default. Rotation therefore changes which version new encryptions use while leaving existing data readable. Rewrapping is an optional forward-migration step, not a requirement, and rotation does not purge older versions.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Decryption of old ciphertext fails after rotation, so every stored record must be re-encrypted with the new key version.
Why it's wrong here
Rotation does not invalidate existing ciphertext. Each ciphertext embeds the key version used to create it, and Vault retains prior versions for decryption, so old records remain readable without any re-encryption. Requiring a bulk re-encryption would make rotation impractical for large datasets and is not how the engine behaves.
- ✗
The application must call the rewrap endpoint on every stored record before any decryption can succeed after a rotation.
Why it's wrong here
Rewrap re-encrypts existing ciphertext under the latest key version without exposing plaintext, but it is optional and used to migrate data forward, not a prerequisite for decryption. Old ciphertext decrypts fine without rewrapping. Confusing rewrap with a mandatory step misstates how version retention works.
- ✓
Old ciphertext decrypts normally because the version prefix selects the correct key version, and new encrypt calls automatically use the latest version.
Why this is correct
The transit engine prefixes ciphertext with the key version, so decryption looks up the matching retained version automatically. After rotation, the newest version becomes the default for new encrypt operations, meaning legacy rows stay readable while fresh writes use the rotated key. This is the designed rotation model and requires no application-side version tracking.
- ✗
Rotation deletes older key versions by default, so only ciphertext produced after the most recent rotation can be decrypted.
Why it's wrong here
Rotation retains older versions precisely so previously encrypted data remains decryptable; versions are only removed if an operator explicitly configures a minimum decryption version or deletes them. The default preserves all versions for decryption. Assuming deletion would push teams toward unnecessary and risky mass re-encryption.
Go deeper
Related to this question
About these practice questions
Courseiva writes every VA-003 question from scratch — 366 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official HashiCorp exam blueprint
This VA-003 practice question is part of Courseiva's free HashiCorp certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the VA-003 exam.